From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D4033101DC for ; Fri, 5 Dec 2025 12:46:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764938797; cv=none; b=P2xIVW/Gqf7sVxDRD9xlY3kXMZapBRCx/1VAzuX6jPhd3E2ZPvcI+xxiZH7wqZPT2wjlf9nXlEo06CKTXVEeyLt1OuOU48lGzrWO9iqXoKW9uK+Q+hP5eksd/cYSuUKbCFyyxWt/luts3nQsSN7tC1LaduCG96cLQqZNi1aKC+U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764938797; c=relaxed/simple; bh=t/V+YjPSO5AnpvzCRWDy+L2H2rs6qPSzjMbMlGl2lCY=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=V0lZuAO49hFLLD8sCUvafI47FUXGjauHAGrcJ96wd6XOU3crxSuC5VRoAk84qidhQD563d5ISWPSs2g5/ZuX3HN8WEQfj/aWBUPIVRWVedjCd8hD64Gr4Fsm3tS2sBtzoSwJ72uG6Jv/eAdQ0RuNjHyVyt/FG4yRSeEjis/SMnc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=e3oyZzUf; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="e3oyZzUf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1764938792; bh=t/V+YjPSO5AnpvzCRWDy+L2H2rs6qPSzjMbMlGl2lCY=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=e3oyZzUfq7aJC0qHJctcCoIEnz3YySE2q5C0rydAjC8rkJ3HtvMxk95jgPMuJAeKF djflUEOc5T5+KgCA8WelEOMr2mehDHEwYJ+tycRt8qZqw4oP19SWSKPo8nlGvxzjDB MAqZgrWrpceL6PGafrE+pYJbPTQfuKRnwrPiK0JFLkLYj5pNH4iy22epLlsgXK0Zga z/9NtV9FXwdEJIB6fb9vqgQUSaAoCBC0Se+BxE2uM+qoeSsu+7B6PmlV7OXP9yHYib eAUXRpn/wn/cbqcsB1uy8FdhOsuFujyr1JHt62m0A93zxyMPiRVihizTV9nPJ89PUY gX7JU42O0VIQg== Received: from fedora (unknown [IPv6:2a01:e0a:2c:6930:d919:a6e:5ea1:8a9f]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 6AE4417E0360; Fri, 5 Dec 2025 13:46:31 +0100 (CET) Date: Fri, 5 Dec 2025 13:46:29 +0100 From: Boris Brezillon To: Chia-I Wu Cc: Tvrtko Ursulin , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Grant Likely , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] drm/panthor: fix for dma-fence safe access rules Message-ID: <20251205134629.608df99b@fedora> In-Reply-To: References: <20251204015034.841235-1-olvaffe@gmail.com> <4e59c6f8-bc9b-4fd5-9b0f-511cce760ac2@igalia.com> Organization: Collabora X-Mailer: Claws Mail 4.3.1 (GTK 3.24.51; x86_64-redhat-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable On Thu, 4 Dec 2025 09:42:37 -0800 Chia-I Wu wrote: > On Thu, Dec 4, 2025 at 1:27=E2=80=AFAM Tvrtko Ursulin wrote: > > > > > > On 04/12/2025 01:50, Chia-I Wu wrote: =20 > > > Commit 506aa8b02a8d6 ("dma-fence: Add safe access helpers and document > > > the rules") details the dma-fence safe access rules. The most common > > > culprit is that drm_sched_fence_get_timeline_name may race with > > > group_free_queue. > > > > > > Fixes: d2624d90a0b77 ("drm/panthor: assign unique names to queues") > > > Signed-off-by: Chia-I Wu > > > --- > > > drivers/gpu/drm/panthor/panthor_sched.c | 4 ++++ > > > 1 file changed, 4 insertions(+) > > > > > > diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/dr= m/panthor/panthor_sched.c > > > index 33b9ef537e359..a8b1347e4da71 100644 > > > --- a/drivers/gpu/drm/panthor/panthor_sched.c > > > +++ b/drivers/gpu/drm/panthor/panthor_sched.c > > > @@ -23,6 +23,7 @@ > > > #include > > > #include > > > #include > > > +#include > > > > > > #include "panthor_devfreq.h" > > > #include "panthor_device.h" > > > @@ -923,6 +924,9 @@ static void group_release_work(struct work_struct= *work) > > > release_work); > > > u32 i; > > > > > > + /* dma-fences may still be accessing group->queues under rcu lo= ck. */ > > > + synchronize_rcu(); > > > + > > > for (i =3D 0; i < group->queue_count; i++) > > > group_free_queue(group, group->queues[i]); > > > =20 > > > > This handles the shared queue->fence_ctx.lock as well (which is also > > unsafe until Christian lands the inline lock, etc patch series) so it > > looks good to me as well. =20 > Yeah, I will send v2 to drop the misleading "Fixes:" tag. >=20 > FWIW, the UAF I saw was from accessing the string returned by >=20 > static const char *drm_sched_fence_get_timeline_name(struct dma_fence *f) > { > struct drm_sched_fence *fence =3D to_drm_sched_fence(f); > return (const char *)fence->sched->name; > } IIRC, the only place calling this callback is some debugsfs knob dumping fences attached to dma_buf resvs, and we're not supposed to expose our driver fences to the outside world (we use the drm_sched_fence proxy for that), so I'm curious where the access was coming from. >=20 > I thought it was "name" and added the "Fixes:" tag. But actually > "sched" was also freed by group_release_work. >=20 > > > > Just to mention an alternative could be to simply switch release_work to > > INIT_RCU_WORK/queue_rcu_work, but I am not sure if that has an advantag= e. > > > > Regards, > > > > Tvrtko > > =20