Message-ID: <sashiko-outbox-207189@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH] drm/sched: Switch the default policy to "fair"
To: "Tvrtko Ursulin" <tvrtko.ursulin@igalia.com>,
 dri-devel@lists.freedesktop.org
In-Reply-To: <20261110141455.28739-1-tvrtko.ursulin@igalia.com>
References: <20261110141455.28739-1-tvrtko.ursulin@igalia.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Tue, 10 Nov 2026 14:25:51 +0000
Precedence: list
Reply-To: sashiko-reviews@lists.linux.dev
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] drm/sched: ZERO_SIZE_PTR dereference in drm_sched_init() [1]
--

commit 50f60e38bc825925735e0e6bb31a4a450af5bbc2
Author: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>

drm/sched: Switch the default policy to "fair"

This commit changes the default DRM GPU scheduler policy from FIFO to
fair and updates the sched_policy module parameter description.

> diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/sch=
eduler/sched_main.c
> index 99252674e2668..a030061d0390c 100644
> --- a/drivers/gpu/drm/scheduler/sched_main.c
> +++ b/drivers/gpu/drm/scheduler/sched_main.c
> @@ -83,13 +83,13 @@
>  #define CREATE_TRACE_POINTS
>  #include "gpu_scheduler_trace.h"
> =20
> -int drm_sched_policy =3D DRM_SCHED_POLICY_FIFO;
> +int drm_sched_policy =3D DRM_SCHED_POLICY_FAIR;

[Severity: High]
This problem wasn't introduced by this patch, but can drm_sched_init()
dereference ZERO_SIZE_PTR on sched->sched_rq [1] when
args->num_rqs is 0 under DRM_SCHED_POLICY_FAIR?

drivers/gpu/drm/scheduler/sched_main.c:drm_sched_init() {
	...
	sched->num_rqs =3D drm_sched_policy !=3D DRM_SCHED_POLICY_FAIR ?
			 args->num_rqs : 1;
	sched->sched_rq =3D kzalloc_objs(*sched->sched_rq, args->num_rqs);
	if (!sched->sched_rq)
		goto Out_check_own;

	for (i =3D DRM_SCHED_PRIORITY_KERNEL; i < sched->num_rqs; i++) {
		sched->sched_rq[i] =3D kzalloc_obj(*sched->sched_rq[i]);
	...
}

When args->num_rqs is 0, it passes the upper-bound check against
DRM_SCHED_PRIORITY_COUNT, and kzalloc_objs() returns ZERO_SIZE_PTR while
sched->num_rqs is overridden to 1 for the fair policy, causing the loop
to dereference sched->sched_rq[0].  Should kzalloc_objs() use
sched->num_rqs instead of args->num_rqs?

[1] https://sashiko.dev/#/bug/linux-5fb1fd33-7544-4ca1-bec8-2b20739ac0dd

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261110141455.2873=
9-1-tvrtko.ursulin@igalia.com?part=3D1