drm/nouveau: Fix race in nouveau_sched_fini()

commit e0023c8a74028739643aa14bd201c41a99866ca4 upstream.

nouveau_sched_fini() uses a memory barrier before wait_event().
wait_event(), however, is a macro which expands to a loop which might
check the passed condition several times. The barrier would only take
effect for the first check.

Replace the barrier with a function which takes the spinlock.

Cc: stable@vger.kernel.org # v6.8+
Fixes: 5f03a507b29e ("drm/nouveau: implement 1:1 scheduler - entity relationship")
Acked-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Philipp Stanner <phasta@kernel.org>
Link: https://patch.msgid.link/20251024161221.196155-2-phasta@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/gpu/drm/nouveau/nouveau_sched.c b/drivers/gpu/drm/nouveau/nouveau_sched.c
index eb6c3f9a01f54a48dd18d23a3bc29ca9982c29b9..9e6244347ed7d8de8d01aeca02d91d01e3f7f05a 100644 (file)
--- a/drivers/gpu/drm/nouveau/nouveau_sched.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sched.c
@@ -475,6 +475,17 @@ nouveau_sched_create(struct nouveau_sched **psched, struct nouveau_drm *drm,
        return 0;
 }
 
+static bool
+nouveau_sched_job_list_empty(struct nouveau_sched *sched)
+{
+       bool empty;
+
+       spin_lock(&sched->job.list.lock);
+       empty = list_empty(&sched->job.list.head);
+       spin_unlock(&sched->job.list.lock);
+
+       return empty;
+}
 
 static void
 nouveau_sched_fini(struct nouveau_sched *sched)
@@ -482,8 +493,7 @@ nouveau_sched_fini(struct nouveau_sched *sched)
        struct drm_gpu_scheduler *drm_sched = &sched->base;
        struct drm_sched_entity *entity = &sched->entity;
 
-       rmb(); /* for list_empty to work without lock */
-       wait_event(sched->job.wq, list_empty(&sched->job.list.head));
+       wait_event(sched->job.wq, nouveau_sched_job_list_empty(sched));
 
        drm_sched_entity_fini(entity);
        drm_sched_fini(drm_sched);