linux-kernel - Re: [PATCH] drm/sched: fix potential page fault in drm_sched_job

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fff7a8db-be77-4c5e-a4dd-82b254adbb78@gmail.com>
Date:   Wed, 8 Nov 2023 00:46:26 -0500
From:   Luben Tuikov <ltuikov89@...il.com>
To:     Danilo Krummrich <dakr@...hat.com>, airlied@...il.com,
        daniel@...ll.ch, christian.koenig@....com
Cc:     linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH] drm/sched: fix potential page fault in
 drm_sched_job_init()

Hi,

Could you please use my gmail address, the one one I'm responding from--I don't want
to miss any DRM scheduler patches. BTW, the luben.tuikov@....com email should bounce
as undeliverable.

On 2023-11-07 21:26, Danilo Krummrich wrote:
> Commit 56e449603f0a ("drm/sched: Convert the GPU scheduler to variable
> number of run-queues") introduces drm_err() in drm_sched_job_init(), in
> order to indicate that the given entity has no runq, however at this
> time job->sched is not yet set, likely to be NULL initialized, and hence
> shouldn't be used.
> 
> Replace the corresponding drm_err() call with pr_err() to avoid a
> potential page fault.
> 
> While at it, extend the documentation of drm_sched_job_init() to
> indicate that job->sched is not a valid pointer until
> drm_sched_job_arm() has been called.
> 
> Fixes: 56e449603f0a ("drm/sched: Convert the GPU scheduler to variable number of run-queues")
> Signed-off-by: Danilo Krummrich <dakr@...hat.com>
> ---
>  drivers/gpu/drm/scheduler/sched_main.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c
> index 27843e37d9b7..dd28389f0ddd 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -680,6 +680,9 @@ EXPORT_SYMBOL(drm_sched_resubmit_jobs);
>   * This function returns -ENOENT in this case (which probably should be -EIO as
>   * a more meanigful return value).
>   *
> + * Note that job->sched is not a valid pointer until drm_sched_job_arm() has
> + * been called.
> + *

Good catch!

Did you actually get this to page-fault and have a kernel log?

I'm asking because we see it correctly set in this kernel log coming from AMD,

[   11.886024] amdgpu 0000:0a:00.0: [drm] *ERROR* drm_sched_job_init: entity has no rq!

in this email,
https://lore.kernel.org/r/CADnq5_PS64jYS_Y3kGW27m-kuWP+FQFiaVcOaZiB=JLSgPnXBQ@mail.gmail.com

>   * Returns 0 for success, negative error code otherwise.
>   */
>  int drm_sched_job_init(struct drm_sched_job *job,
> @@ -691,7 +694,7 @@ int drm_sched_job_init(struct drm_sched_job *job,
>  		 * or worse--a blank screen--leave a trail in the
>  		 * logs, so this can be debugged easier.
>  		 */
> -		drm_err(job->sched, "%s: entity has no rq!\n", __func__);
> +		pr_err("%s: entity has no rq!\n", __func__);

Is it feasible to do something like the following?

		dev_err(job->sched ? job->sched->dev : NULL, "%s: entity has no rq!\n", __func__);

>  		return -ENOENT;
>  	}
>  
> 
> base-commit: c015fb6d01adb616fb54824feb55ce5ab18e8ca1

-- 
Regards,
Luben

Download attachment "OpenPGP_0x4C15479431A334AF.asc" of type "application/pgp-keys" (665 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)