Skip to contentSkip to conversation

drm/nouveau: Fix race in nouveau_sched_fini()

PATCH Applied Philipp Stanner 3 participants 3 messages Oct 24, 2025 – Oct 27, 2025

Subsystems (4)
Stable branch DRM drivers DRM misc nouveau
lore
Share & tools
lore

Philipp Stanner

author
#0 lore raw

PATCH 1/1 drm/nouveau: Fix race in nouveau_sched_fini()

nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check.

Replace the barrier with a function which takes the spinlock.

Cc [email protected] # v6.8+
Fixes 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
Signed-off-by Philipp Stanner <[email protected]>
---
 drivers/gpu/drm/nouveau/nouveau_sched.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)
drivers/gpu/drm/nouveau/nouveau_sched.c +12 -2
index e60f7892f5ce..a7bf539e5d86 100644
@@ -482,6 +482,17 @@ nouveau_sched_create(struct nouveau_sched **psched, struct nouveau_drm *drm,
 	return 0;
 }
 
+static bool
+nouveau_sched_job_list_empty(struct nouveau_sched *sched)
+{
+	bool empty;
+
+	spin_lock(&sched->job.list.lock);
+	empty = list_empty(&sched->job.list.head);
+	spin_unlock(&sched->job.list.lock);
+
+	return empty;
+}
 
 static void
 nouveau_sched_fini(struct nouveau_sched *sched)

@@ -489,8 +500,7 @@ nouveau_sched_fini(struct nouveau_sched *sched)
 	struct drm_gpu_scheduler *drm_sched = &sched->base;
 	struct drm_sched_entity *entity = &sched->entity;
 
-	rmb(); /* for list_empty to work without lock */
-	wait_event(sched->job.wq, list_empty(&sched->job.list.head));
+	wait_event(sched->job.wq, nouveau_sched_job_list_empty(sched));
 
 	drm_sched_entity_fini(entity);
 	drm_sched_fini(drm_sched);
Signature · 1 line
2.49.0
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 10 lines · Philipp Stanner

nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check.

Replace the barrier with a function which takes the spinlock.

Cc [email protected] # v6.8+
Fixes 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
Signed-off-by Philipp Stanner <[email protected]>
Acked-by Danilo Krummrich <[email protected]>
Applied
#2 lore raw
Quoted 6 lines · Danilo Krummrich
Quoted 5 lines · Philipp Stanner

nouveau_sched_fini() uses a memory barrier before wait_event(). wait_event(), however, is a macro which expands to a loop which might check the passed condition several times. The barrier would only take effect for the first check.

Quoted 7 lines
Quoted 5 lines

Replace the barrier with a function which takes the spinlock.

Cc [email protected] # v6.8+
Fixes 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
Signed-off-by Philipp Stanner <[email protected]>
Acked-by Danilo Krummrich <[email protected]>

Applied to drm-misc-fixes

P.