On Wed, Dec 11, 2024 at 12:13 PM Pierre-Eric Pelloux-Prayer
<pierre-eric.pelloux-prayer@xxxxxxx> wrote:
>
> Since 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
> accessing job->base.sched can produce unexpected results as the initialisation
> of (*job)->base.sched done in amdgpu_job_alloc is overwritten by the
> memset.
>
> This commit fixes an issue when a CS would fail validation and would
> be rejected after job->num_ibs is incremented. In this case,
> amdgpu_ib_free(ring->adev, ...) will be called, which would crash the
> machine because the ring value is bogus.
>
> To fix this, pass a NULL pointer to amdgpu_ib_free(): we can do this
> because the device is actually not used in this function.
>
> The next commit will remove the ring argument completely.
>
> Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@xxxxxxx>
Please add:
Fixes: 2320c9e6a768 ("drm/sched: memset() 'job' in drm_sched_job_init()")
With that, the series is:
Reviewed-by: Alex Deucher <alexander.deucher@xxxxxxx>
> ---
> drivers/gpu/drm/amd/amdgpu/amdgpu_job.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> index 9b322569255e..9ec8d5a8e48c 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_job.c
> @@ -256,7 +256,6 @@ void amdgpu_job_set_resources(struct amdgpu_job *job, struct amdgpu_bo *gds,
>
> void amdgpu_job_free_resources(struct amdgpu_job *job)
> {
> - struct amdgpu_ring *ring = to_amdgpu_ring(job->base.sched);
> struct dma_fence *f;
> unsigned i;
>
> @@ -269,7 +268,7 @@ void amdgpu_job_free_resources(struct amdgpu_job *job)
> f = NULL;
>
> for (i = 0; i < job->num_ibs; ++i)
> - amdgpu_ib_free(ring->adev, &job->ibs[i], f);
> + amdgpu_ib_free(NULL, &job->ibs[i], f);
> }
>
> static void amdgpu_job_free_cb(struct drm_sched_job *s_job)
> --
> 2.43.0
>
