<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=gb2312"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="ZH-CN" link="#0563C1" vlink="#954F72" style="text-justify-trim:punctuation"> <div class="WordSection1"> *Correctio for the scenario *<o:p></o:p> <o:p> </o:p> After we move fence_put(entity->last_sched) out of the fini_status check:<o:p></o:p> <o:p> </o:p> <o:p> </o:p> A potential race issue for the scenario:<o:p></o:p> <o:p> </o:p> <![if !supportLists]>1. <![endif]>Drm_sched_entity_fini(): it exit right after entity->job_queue empty, [ but that time scheduler is not fast enough to deal with this entity now ]<o:p></o:p> <![if !supportLists]>2. <![endif]>Drm_sched_entity_cleanup() : it call dma_fence_put(entity->last_scheduled) [ but this time entity->last_scheduled actually points to the fence prior to the real last one ]<o:p></o:p> <![if !supportLists]>3. <![endif]>Scheduler_main() now dealing with this entity: it call dma_fence_put(entity->last_scheduled) [ Now this fence get double put !!! ]<o:p></o:p> <![if !supportLists]>4. <![endif]>Scheduler_main() now call dma_fence_get() on the *real* last one !<o:p></o:p> <o:p> </o:p> So eventually the real last one fence triggers memory leak and more critical the double put fence cause NULL pointer access <o:p></o:p> <o:p> </o:p> /Monk<o:p></o:p> <o:p> </o:p> <div> <div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Liu, Monk Sent: 2018年4月18日 15:11 To: Koenig, Christian <Christian.Koenig@amd.com>; Deng, Emily <Emily.Deng@amd.com> Cc: amd-gfx@lists.freedesktop.org Subject: force app kill patch<o:p></o:p> </div> </div> <o:p> </o:p> Hi Christian & Emily<o:p></o:p> <o:p> </o:p> I think the v4 fix for “fix force app kill hang” is still not good enough:<o:p></o:p> <o:p> </o:p> <o:p> </o:p> First:<o:p></o:p> See that in “sched_entity_fini”, we only call dma_fence_put(entity->last_scheduled” under the condition of “If (entity->fini_status)”, so <o:p></o:p> This way there is memory leak for the case of “entity->fini_stats ==0”<o:p></o:p> <o:p> </o:p> <o:p> </o:p> Second:<o:p></o:p> If we move dma_fence_put(entity->last_scheduled) out of the condition of “if (entity->fini_status)”, the memory leak issue can be fixed <o:p></o:p> But there will be kernel NULL pointer access, I think the time you call dma_fence_put(entity->last_scheduled”) may actually executed *not*<o:p></o:p> On the last scheduled fence of this entity, because it is run without “thread_park/unpark” pair which to make sure scheduler not dealing this entity<o:p></o:p> <o:p> </o:p> So with certain race issue, here is the scenario:<o:p></o:p> <o:p> </o:p> <![if !supportLists]>1. <![endif]>scheduler is doing the dma_fence_put() on the 1st fence, <o:p></o:p> <![if !supportLists]>2. <![endif]>scheduler set entity->last_scheduled to 1st fence<o:p></o:p> <![if !supportLists]>3. <![endif]>now sched_entity_fini() run, and it call dma_fence_put() on entity->last_scheduled <o:p></o:p> <![if !supportLists]>4. <![endif]>now this 1st fence is actually put double time and the real last fence won’t get put by expected <o:p></o:p> <o:p> </o:p> <o:p> </o:p> any idea?<o:p></o:p> <o:p> </o:p> <o:p> </o:p> /Monk<o:p></o:p> </div> </body> </html>