[PATCH] drm/i915/selftests: read the noop seqno before dropping the request

[PATCH] drm/i915/selftests: read the noop seqno before dropping the request

[Wentao Liang]

perf_mi_noop() waits for the request it has just submitted, drops the
reference taken with i915_request_get() and only then reads
rq->hwsp_seqno[].

i915_request_wait() returns as soon as the fence is signaled, which
happens in i915_request_retire() before it puts the request's initial
reference.  If retirement has already run, the put in this loop is the
last one and i915_request_put() frees the request, so the seqno is read
from an object that the SLAB_TYPESAFE_BY_RCU slab cache can already have
handed out to another user.

Sample the seqno while the reference is still held.

Fixes: 3c7a44bbbfa7 ("drm/i915/selftests: Perform some basic cycle counting of MI ops")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/i915/gt/selftest_engine_cs.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
index 1846f1c7e77e..f894902f5509 100644
--- a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
@@ -357,13 +357,19 @@ static int perf_mi_noop(void *arg)
 
 			if (i915_request_wait(rq, 0, HZ / 5) < 0)
 				err = -EIO;
+
+			/*
+			 * The request can be freed as soon as its last
+			 * reference is dropped, so read the seqno first.
+			 */
+			if (!err)
+				cycles[i] =
+					(rq->hwsp_seqno[4] - rq->hwsp_seqno[3]) -
+					(rq->hwsp_seqno[3] - rq->hwsp_seqno[2]);
+
 			i915_request_put(rq);
 			if (err)
 				break;
-
-			cycles[i] =
-				(rq->hwsp_seqno[4] - rq->hwsp_seqno[3]) -
-				(rq->hwsp_seqno[3] - rq->hwsp_seqno[2]);
 		}
 		i915_vma_put(nop);
 		i915_vma_put(base);
-- 
2.34.1

Re: [PATCH] drm/i915/selftests: read the noop seqno before dropping the request

[Krzysztof Kozlowski]

On Wed, 04 Nov 2026 02:53:44 +0000, Wentao Liang wrote:
> perf_mi_noop() waits for the request it has just submitted, drops the
> reference taken with i915_request_get() and only then reads
> rq->hwsp_seqno[].
> 
> i915_request_wait() returns as soon as the fence is signaled, which
> happens in i915_request_retire() before it puts the request's initial
> reference.  If retirement has already run, the put in this loop is the
> last one and i915_request_put() frees the request, so the seqno is read
> from an object that the SLAB_TYPESAFE_BY_RCU slab cache can already have
> handed out to another user.
> 
> Sample the seqno while the reference is still held.
> 
> Fixes: 3c7a44bbbfa7 ("drm/i915/selftests: Perform some basic cycle counting of MI ops")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/i915/gt/selftest_engine_cs.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

✗ LGCI.VerificationFailed: failure for drm/i915/selftests: read the noop seqno before dropping the request

[Patchwork]

== Series Details ==

Series: drm/i915/selftests: read the noop seqno before dropping the request
URL   : https://patchwork.freedesktop.org/series/177742/
State : failure

== Summary ==

Series author address 'vulab@iscas.ac.cn' is not on the allowlist, which prevents CI from being automatically triggered.
If you want CI to run for this series, ask Patchwork project owners to click 'retest' on the series in Patchwork.
Exception occurred during validation, bailing out!
Build URL: http://gfx-ci.igk.intel.com:8080/job/CI_PW_kernel/192067/ (on built-in)

Re: [PATCH] drm/i915/selftests: read the noop seqno before dropping the request

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/i915/selftests: rq->hwsp_seqno overwrite on retire in perf_mi_noop()
--

commit 00425305585429060b5834586fddd6fa9a9e06c4
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/i915/selftests: read the noop seqno before dropping the request

This commit moves the read of rq->hwsp_seqno[] in perf_mi_noop() before
i915_request_put(rq) so that the request is not freed before the seqno slots
are sampled.

> diff --git a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> index 5ffa5e30f4192..cfe73b51557a1 100644
> --- a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> +++ b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
> @@ -351,13 +351,19 @@ static int perf_mi_noop(void *arg)
>  
>  			if (i915_request_wait(rq, 0, HZ / 5) < 0)
>  				err = -EIO;
> +
> +			/*
> +			 * The request can be freed as soon as its last
> +			 * reference is dropped, so read the seqno first.
> +			 */
> +			if (!err)
> +				cycles[i] =
> +					(rq->hwsp_seqno[4] - rq->hwsp_seqno[3]) -
> +					(rq->hwsp_seqno[3] - rq->hwsp_seqno[2]);

[Severity: Medium]
If i915_request_retire(rq) has already run (or runs concurrently), will
reading rq->hwsp_seqno[2..4] here still read out of bounds of
rq->fence.seqno instead of reading the timeline HWSP?

At the start of i915_request_retire(), before signaling rq->fence or
dropping the request reference, it calls i915_request_mark_complete():

drivers/gpu/drm/i915/i915_request.c:i915_request_retire() {
	...
	trace_i915_request_retire(rq);
	i915_request_mark_complete(rq);
	...
}

drivers/gpu/drm/i915/i915_request.h:i915_request_mark_complete() {
	WRITE_ONCE(rq->hwsp_seqno, /* decouple from HWSP */
		   (u32 *)&rq->fence.seqno);
}

Holding a reference via i915_request_get(rq) keeps the request object alive,
but once i915_request_mark_complete(rq) executes, rq->hwsp_seqno points to
rq->fence.seqno inside struct dma_fence rather than the timeline HWSP where
write_timestamp() wrote slots 2, 3, and 4. Indexing rq->hwsp_seqno[2..4]
then reads past the 64-bit rq->fence.seqno field into adjacent fields of
struct dma_fence.

Should perf_mi_noop() save the timeline HWSP pointer (for example from
rq->hwsp_seqno or ce->timeline->hwsp_seqno) before calling
i915_request_add(rq), similar to __live_rc6_ctx() in
drivers/gpu/drm/i915/gt/selftest_rc6.c?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104025344.1527492-1-vulab@iscas.ac.cn?part=1