linux-kernel - [PATCH V3] drm/sched: Fix fence reference count leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250310094216.3821893-1-liuqianyi125@gmail.com>
Date: Mon, 10 Mar 2025 17:42:16 +0800
From: Qianyi Liu <liuqianyi125@...il.com>
To: phasta@...lbox.org
Cc: airlied@...il.com,
	ckoenig.leichtzumerken@...il.com,
	dakr@...nel.org,
	daniel@...ll.ch,
	dri-devel@...ts.freedesktop.org,
	linux-kernel@...r.kernel.org,
	liuqianyi125@...il.com,
	maarten.lankhorst@...ux.intel.com,
	matthew.brost@...el.com,
	mripard@...nel.org,
	phasta@...nel.org,
	stable@...r.kernel.org,
	tzimmermann@...e.de
Subject: [PATCH V3] drm/sched: Fix fence reference count leak

> Sorry for the delay
>
> On Wed, 2025-02-26 at 17:05 +0800, Qianyi Liu wrote:
>> From: qianyi liu <liuqianyi125@...il.com>
>>
>> The last_scheduled fence leaked when an entity was being killed and
>> adding its callback failed.
>
> s/leaked/leaks
>
> s/was being/is being
>
> s/its callback/the cleanup callback
>
> s/failed/fails

>>
>> Decrement the reference count of prev when dma_fence_add_callback()
>> fails, ensuring proper balance.
>>
>> Cc: stable@...r.kernel.org
>> Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and
>> fini")
>> Signed-off-by: qianyi liu <liuqianyi125@...il.com>
>> ---
>> v2 -> v3: Rework commit message (Markus)
>> v1 -> v2: Added 'Fixes:' tag and clarified commit message (Philipp
>> and Matthew)
>> ---
>>  drivers/gpu/drm/scheduler/sched_entity.c | 7 +++++--
>>  1 file changed, 5 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/scheduler/sched_entity.c
>> b/drivers/gpu/drm/scheduler/sched_entity.c
>> index 69bcf0e99d57..1c0c14bcf726 100644
>> --- a/drivers/gpu/drm/scheduler/sched_entity.c
>> +++ b/drivers/gpu/drm/scheduler/sched_entity.c
>> @@ -259,9 +259,12 @@ static void drm_sched_entity_kill(struct
>> drm_sched_entity *entity)
>>  		struct drm_sched_fence *s_fence = job->s_fence;
>>
>>  		dma_fence_get(&s_fence->finished);
>> -		if (!prev || dma_fence_add_callback(prev, &job-
>> >finish_cb,
>> -
>> drm_sched_entity_kill_jobs_cb))
>> +		if (!prev ||
>> +		    dma_fence_add_callback(prev, &job->finish_cb,
>> +
>> drm_sched_entity_kill_jobs_cb)) {
>> +			dma_fence_put(prev);
>
> Please add a little comment about the dma_fence_put()'s purpose. Sth
> like "Adding callback above failed. dma_fence_put() checks for NULL."
>
> Then we should be good I think
>
> Thx

OK, thank you for your detailed feedback.

Best regards.
QianYi.