Re: [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free

[Christian König]

On 9/7/26 15:38, Philipp Stanner wrote:
> On Mon, 2026-09-07 at 14:59 +0200, Christian König wrote:
>> I think the memory ordering isn't really a problem.
>>
>> See if the ops pointer or the signaled bit is loaded first doesn't
>> matter if you check both.
>>
>> You only need to make sure that the ops pointer is loaded once cause
>> that one is used multiple times, but that is already the case by
>> using rcu_dereference().
> 
> That.. sounds correct.
> 
> Although I still don't get why we then can't use the signaled state
> everywhere instead of the ops pointer. That would be simpler.

Yeah I have considered that as well.

But I wanted a) to let trace_dma_fence_signaled() be able to trace timeline and driver name for the last time and b) not keep an invalid ops pointer around.

Setting ops to NULL caused some trouble but I think we have solved most of that now.

> Anyways.
> Maybe Jonghyuk can give your patch a test run and then we could use it
> as a hot-fix to backport and discuss the wider future of dma-fence
> separately?

Completely agree.

Regards,
Christian.

> 
> 
> P.