Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [Critical] The drm_exec_lock_obj_report_dup helper fails to bypass the DRM_EXEC_IGNORE_DUPLICATES flag, causing premature unlocking and use-after-free of already-reserved buffers. - [Medium] The trylock_only and no_wait_gpu flags are ignored when ctx->exec is set, forcing synchronous blocking locks during fast/non-blocking eviction passes. --
commit 013bce350b89f0772194d9c2194cd802f5e36ff2 Author: Christian König <[email protected]> drm/ttm: support using drm_exec during eviction v4 Allow specifying a drm_exec object in TTMs operation context which is used to lock objects during eviction. This allows to handle deadlocks much more gracefully and with that avoid returning -ENOMEM on heavily contended domains. > diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c > b/drivers/gpu/drm/ttm/ttm_bo_util.c > index a53b25e8c2967..96699532817c2 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo_util.c > +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c [ ... ] > @@ -837,6 +838,8 @@ static bool ttm_lru_walk_trylock(struct ttm_bo_lru_cursor > *curs, > struct ttm_operation_ctx *ctx = curs->arg->ctx; > > curs->needs_unlock = false; > + if (ctx->exec) > + return false; [Severity: Medium] Will this force a blocking lock during fast/non-blocking eviction passes? By returning false unconditionally when ctx->exec is set, we bypass the trylock here. Later in __ttm_bo_lru_cursor_next(), the added !arg->ctx->exec check prevents skipping the buffer, forcing a fall-through to ttm_lru_walk_ticketlock() which performs a blocking lock. This seems to ignore the trylock_only and no_wait_gpu flags. > if (dma_resv_trylock(bo->base.resv)) { > curs->needs_unlock = true; [ ... ] > @@ -857,7 +860,9 @@ static int ttm_lru_walk_ticketlock(struct > ttm_bo_lru_cursor *curs, > struct ttm_lru_walk_arg *arg = curs->arg; > int ret; > > - if (arg->ctx->interruptible) > + if (arg->ctx->exec) > + ret = drm_exec_lock_obj_report_dup(arg->ctx->exec, &bo->base); > + else if (arg->ctx->interruptible) > ret = dma_resv_lock_interruptible(bo->base.resv, arg->ticket); [ ... ] > @@ -937,12 +946,17 @@ static void ttm_bo_lru_cursor_cleanup_bo(struct > ttm_bo_lru_cursor *curs) > { > struct ttm_buffer_object *bo = curs->bo; > > - if (bo) { > - if (curs->needs_unlock) > + if (!bo) > + return; > + > + if (curs->needs_unlock) { > + if (curs->arg->ctx->exec) > + drm_exec_unlock_obj(curs->arg->ctx->exec, &bo->base); [Severity: Critical] Can this cause a use-after-free for already-reserved buffers? Looking at drm_exec_lock_obj_report_dup() used in ttm_lru_walk_ticketlock(), it passes false for the always_report_duplicates parameter: drivers/gpu/drm/drm_exec.c:drm_exec_lock_obj_report_dup() { return __drm_exec_lock_obj(exec, obj, false); } If DRM_EXEC_IGNORE_DUPLICATES is set, it returns 0 instead of -EALREADY for duplicate locks. When this happens, ttm_lru_walk_ticketlock() will see ret == 0 and set curs->needs_unlock = true. Because of this, when ttm_bo_lru_cursor_cleanup_bo() runs, it sees needs_unlock is true and calls drm_exec_unlock_obj() here, which unlocks the object and drops its reference. This completely removes the buffer from the caller's outer WW transaction. > + else > dma_resv_unlock(bo->base.resv); > - ttm_bo_put(bo); > - curs->bo = NULL; > } > + ttm_bo_put(bo); > + curs->bo = NULL; > } [ ... ] > @@ -1016,8 +1030,8 @@ __ttm_bo_lru_cursor_next(struct ttm_bo_lru_cursor *curs) > if (ttm_lru_walk_trylock(curs, bo)) { > bo_locked = true; > > - } else if (!arg->ticket || arg->ctx->no_wait_gpu || > - arg->trylock_only) { > + } else if ((!arg->ticket || arg->ctx->no_wait_gpu || > + arg->trylock_only) && !arg->ctx->exec) { > spin_unlock(lru_lock); > ttm_bo_put(bo); > spin_lock(lru_lock); -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=9
