Am 10.04.25 um 11:24 schrieb Philipp Stanner:

Nouveau currently relies on the assumption that dma_fences will only ever get signaled through nouveau_fence_signal(), which takes care of removing a signaled fence from the list nouveau_fence_chan.pending.

This self-imposed rule is violated in nouveau_fence_done(), where dma_fence_is_signaled() (somewhat surprisingly, considering its name) can signal the fence without removing it from the list. This enables accesses to already signaled fences through the list, which is a bug.

In particular, it can race with nouveau_fence_context_kill(), which would then attempt to set an error code on an already signaled fence, which is illegal.

In nouveau_fence_done(), the call to nouveau_fence_update() already ensures to signal all ready fences. Thus, the signaling potentially performed by dma_fence_is_signaled() is actually not necessary.

Replace the call to dma_fence_is_signaled() with nouveau_fence_base_is_signaled().

Cc: stable@vger.kernel.org # 4.10+, precise commit not to be determined Signed-off-by: Philipp Stanner phasta@kernel.org

---

drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c index 7cc84472cece..33535987d8ed 100644 --- a/drivers/gpu/drm/nouveau/nouveau_fence.c +++ b/drivers/gpu/drm/nouveau/nouveau_fence.c @@ -274,7 +274,7 @@ nouveau_fence_done(struct nouveau_fence *fence) nvif_event_block(&fctx->event); spin_unlock_irqrestore(&fctx->lock, flags); }

• return dma_fence_is_signaled(&fence->base);

• return test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);

See the code above that:

if (fence->base.ops == &nouveau_fence_ops_legacy ||             fence->base.ops == &nouveau_fence_ops_uevent) { ....

Nouveau first tests if it's one of it's own fences, and if yes does some special handling. E.g. checking the fence status bits etc...

So this dma_fence_is_signaled() is for all non-nouveau fences and then not touching the internal flags is perfectly correct as far as I can see.

Regards, Christian.

} static long