perf_mi_bb_start() waits for the request it has just submitted, drops the
reference taken with i915_request_get() and only then reads
rq->hwsp_seqno[].
i915_request_wait() returns as soon as the fence is signaled, which
happens in i915_request_retire() before it puts the request's initial
reference. If retirement has already run, the put in this loop is the
last one and i915_request_put() frees the request, so the seqno is read
from an object that the SLAB_TYPESAFE_BY_RCU slab cache can already have
handed out to another user.
Sample the seqno while the reference is still held.
Fixes: 3c7a44bbbfa7 ("drm/i915/selftests: Perform some basic cycle counting of
MI ops")
Cc: [email protected]
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <[email protected]>
---
drivers/gpu/drm/i915/gt/selftest_engine_cs.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
index 5ffa5e30f419..1846f1c7e77e 100644
--- a/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/selftest_engine_cs.c
@@ -196,11 +196,17 @@ static int perf_mi_bb_start(void *arg)
if (i915_request_wait(rq, 0, HZ / 5) < 0)
err = -EIO;
+
+ /*
+ * The request can be freed as soon as its last
+ * reference is dropped, so read the seqno first.
+ */
+ if (!err)
+ cycles[i] = rq->hwsp_seqno[3] -
rq->hwsp_seqno[2];
+
i915_request_put(rq);
if (err)
break;
-
- cycles[i] = rq->hwsp_seqno[3] - rq->hwsp_seqno[2];
}
i915_vma_put(batch);
intel_engine_pm_put(engine);
--
2.34.1
