Re: [PATCH v4 1/3] drm/sched: cache the timeline name to fix a use-after-free

[Philipp Stanner]

On Tue, 2026-09-08 at 19:49 +0900, Jonghyuk Kim(MalHyuk) wrote:
> Tested-by: Jonghyuk Kim(MalHyuk) <malhyuk97@xxxxxxxxx>
> 
> Two things it doesn't cover: it's x86 only, so nothing about the load ordering
> you discussed;

Christian and I think that it shouldn't be an issue anymore. Both
values are loaded and the ops pointer cannot become invalid until an
RCU grace period has passed. Similarly, sched must not be cleaned up
before that.


>  and only the signaled case - for a fence exported before it
> signals, get_timeline_name() is still reached and reads fence->sched->name.

Is this an issue? A fence can only be exported if the scheduler exists.

The hard rule with dma_fence is that all drivers must signal all of
them before they tear down the scheduler and clean up driver resources.
This then does the decoupling.

I think that rule is really the only chance we have to get things
right.

> I haven't tried to build that case.
> 
> Could you add a Reported-by for me when you post it? I'm happy to drop my
> v4 1/3 in favour of this, and can respin the KUnit test standalone so the
> fix lands with a regression test.

+1
I think since it's @Christian's patch he'll take care of it


Thanks
P.