Re: [PATCH v3 1/2] drm/sched: fix use-after-free of the fence timeline name

[Christian König]

On 9/3/26 10:46, Philipp Stanner wrote:
> On Wed, 2026-09-02 at 23:42 +0900, Jonghyuk Kim(MalHyuk) wrote:
...
>> -}
>> -
>> -/**
>> - * drm_sched_fence_release_finished - drop extra reference
>> - *
>> - * @f: fence
>> - *
>> - * Drop the extra reference from the scheduled fence to the base fence.
>> - */
>> -static void drm_sched_fence_release_finished(struct dma_fence *f)
>> -{
>> -	struct drm_sched_fence *fence = to_drm_sched_fence(f);
>> -
>> -	dma_fence_put(&fence->scheduled);
>> +	/*
>> +	 * Drop the reference the scheduled fence holds on the finished fence.
>> +	 * The finished fence is released last and frees the shared allocation
>> +	 * from its dma_fence_free() (see drm_sched_fence_init()).
>> +	 */
>> +	dma_fence_put(&fence->finished);

That doesn't looks correct to me. The reference *must* be from the finished to the scheduled fence and not the other way around.

Background is that there are a lot of use cases which needs to convert from finished to scheduled and only a handful which does the other way around and in those cases we also hold a reference to the finished fence.

That here would completely break this.

Regards,
Christian.