[PATCH] drm/xe: Make sure scheduler is ready before submission

[Matthew Brost]

On Thu, Feb 20, 2025 at 06:08:59PM +0530, Tejas Upadhyay wrote:
> Async call to __guc_exec_queue_fini_async frees scheduler
> while some scheduler submission would have already started.
> To handle such small window race case, submission should only
> start when scheduler is ready.
> 
> It will help to solve below which is not easily reproducible,
> https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4223
> 

I don't think this help. We can only enter xe_sched_submission_start if
exec queue is in &guc->submission_state.exec_queue_lookup and remove the
exec queue under a mutex in release_guc_id before we call
xe_sched_fini which flips the ready state to false. We then immediately
free the scheduler - we'd be getting a UAF in xe_sched_submission_start
anyways.

The gitlab issue looks like a memory corruption. Basically it is saying
a variable which is a bool is reading 107 which shouldn't be possible.

Matt

> Signed-off-by: Tejas Upadhyay <tejas.upadhyay at intel.com>
> ---
>  drivers/gpu/drm/xe/xe_gpu_scheduler.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_gpu_scheduler.c b/drivers/gpu/drm/xe/xe_gpu_scheduler.c
> index 50361b4638f9..42ca3c4a299a 100644
> --- a/drivers/gpu/drm/xe/xe_gpu_scheduler.c
> +++ b/drivers/gpu/drm/xe/xe_gpu_scheduler.c
> @@ -80,6 +80,14 @@ void xe_sched_fini(struct xe_gpu_scheduler *sched)
>  
>  void xe_sched_submission_start(struct xe_gpu_scheduler *sched)
>  {
> +	/* Async call to __guc_exec_queue_fini_async frees scheduler
> +	 * while some scheduler submission would have already started.
> +	 * To handle such small window race case, submission should only
> +	 * start when scheduler is ready.
> +	 */
> +	if (!drm_sched_wqueue_ready(&sched->base))
> +		return;
> +
>  	drm_sched_wqueue_start(&sched->base);
>  	queue_work(sched->base.submit_wq, &sched->work_process_msg);
>  }
> -- 
> 2.34.1
>