diff options
Diffstat (limited to 'common/recipes-kernel/linux/files/0802-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch')
| -rw-r--r-- | common/recipes-kernel/linux/files/0802-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch | 60 |
1 files changed, 60 insertions, 0 deletions
diff --git a/common/recipes-kernel/linux/files/0802-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch b/common/recipes-kernel/linux/files/0802-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch new file mode 100644 index 00000000..7612e22c --- /dev/null +++ b/common/recipes-kernel/linux/files/0802-drm-amdgpu-fix-race-condition-in-amd_sched_entity_pu.patch @@ -0,0 +1,60 @@ +From 11227ff421587058d80ce5bb214817763ed5e94a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= <Nicolai.Haehnle@amd.com> +Date: Wed, 2 Dec 2015 17:35:12 +0100 +Subject: [PATCH 0802/1050] drm/amdgpu: fix race condition in + amd_sched_entity_push_job +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +As soon as we leave the spinlock after the job has been added to the job +queue, we can no longer rely on the job's data to be available. + +I have seen a null-pointer dereference due to sched == NULL in +amd_sched_wakeup via amd_sched_entity_push_job and +amd_sched_ib_submit_kernel_helper. Since the latter initializes +sched_job->sched with the address of the ring scheduler, which is +guaranteed to be non-NULL, this race appears to be a likely culprit. + +Signed-off-by: Nicolai Hähnle <nicolai.haehnle@amd.com> +Bugzilla: https://bugs.freedesktop.org/attachment.cgi?bugid=93079 +Reviewed-by: Christian König <christian.koenig@amd.com> +--- + drivers/gpu/drm/amd/scheduler/gpu_scheduler.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c +index e13b7a0..5ace1a7 100644 +--- a/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c ++++ b/drivers/gpu/drm/amd/scheduler/gpu_scheduler.c +@@ -288,6 +288,7 @@ amd_sched_entity_pop_job(struct amd_sched_entity *entity) + */ + static bool amd_sched_entity_in(struct amd_sched_job *sched_job) + { ++ struct amd_gpu_scheduler *sched = sched_job->sched; + struct amd_sched_entity *entity = sched_job->s_entity; + bool added, first = false; + +@@ -302,7 +303,7 @@ static bool amd_sched_entity_in(struct amd_sched_job *sched_job) + + /* first job wakes up scheduler */ + if (first) +- amd_sched_wakeup(sched_job->sched); ++ amd_sched_wakeup(sched); + + return added; + } +@@ -318,9 +319,9 @@ void amd_sched_entity_push_job(struct amd_sched_job *sched_job) + { + struct amd_sched_entity *entity = sched_job->s_entity; + ++ trace_amd_sched_job(sched_job); + wait_event(entity->sched->job_scheduled, + amd_sched_entity_in(sched_job)); +- trace_amd_sched_job(sched_job); + } + + /** +-- +1.9.1 + |