Hi all,

Today's linux-next merge of the drm-xe tree got a conflict in:

  drivers/gpu/drm/xe/xe_guc_submit.c

between commit:

  9286a191abe2 ("drm/xe: Drop GuC submit_wq pool")

from the drm-misc-fixes tree and commit:

  861108666cc0 ("drm/xe: fix UAF around queue destruction")

from the drm-xe tree.

I fixed it up (see below) and can carry the fix as necessary. This
is now fixed as far as linux-next is concerned, but any non trivial
conflicts should be mentioned to your upstream maintainer when your tree
is submitted for merging.  You may also want to consider cooperating
with the maintainer of the conflicting tree to minimise any particularly
complex conflicts.

-- 
Cheers,
Stephen Rothwell

diff --cc drivers/gpu/drm/xe/xe_guc_submit.c
index 17c25f18e286,8a5c21a87977..000000000000
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@@ -224,11 -224,80 +224,27 @@@ static bool exec_queue_killed_or_banned
  		 EXEC_QUEUE_STATE_BANNED));
  }
  
 -#ifdef CONFIG_PROVE_LOCKING
 -static int alloc_submit_wq(struct xe_guc *guc)
 -{
 -	int i;
 -
 -	for (i = 0; i < NUM_SUBMIT_WQ; ++i) {
 -		guc->submission_state.submit_wq_pool[i] =
 -			alloc_ordered_workqueue("submit_wq", 0);
 -		if (!guc->submission_state.submit_wq_pool[i])
 -			goto err_free;
 -	}
 -
 -	return 0;
 -
 -err_free:
 -	while (i)
 -		destroy_workqueue(guc->submission_state.submit_wq_pool[--i]);
 -
 -	return -ENOMEM;
 -}
 -
 -static void free_submit_wq(struct xe_guc *guc)
 -{
 -	int i;
 -
 -	for (i = 0; i < NUM_SUBMIT_WQ; ++i)
 -		destroy_workqueue(guc->submission_state.submit_wq_pool[i]);
 -}
 -
 -static struct workqueue_struct *get_submit_wq(struct xe_guc *guc)
 -{
 -	int idx = guc->submission_state.submit_wq_idx++ % NUM_SUBMIT_WQ;
 -
 -	return guc->submission_state.submit_wq_pool[idx];
 -}
 -#else
 -static int alloc_submit_wq(struct xe_guc *guc)
 -{
 -	return 0;
 -}
 -
 -static void free_submit_wq(struct xe_guc *guc)
 -{
 -
 -}
 -
 -static struct workqueue_struct *get_submit_wq(struct xe_guc *guc)
 -{
 -	return NULL;
 -}
 -#endif
 -
+ static void xe_guc_submit_fini(struct xe_guc *guc)
+ {
+ 	struct xe_device *xe = guc_to_xe(guc);
+ 	struct xe_gt *gt = guc_to_gt(guc);
+ 	int ret;
+ 
+ 	ret = wait_event_timeout(guc->submission_state.fini_wq,
+ 				 xa_empty(&guc->submission_state.exec_queue_lookup),
+ 				 HZ * 5);
+ 
+ 	drain_workqueue(xe->destroy_wq);
+ 
+ 	xe_gt_assert(gt, ret);
+ }
+ 
  static void guc_submit_fini(struct drm_device *drm, void *arg)
  {
  	struct xe_guc *guc = arg;
  
+ 	xe_guc_submit_fini(guc);
  	xa_destroy(&guc->submission_state.exec_queue_lookup);
 -	free_submit_wq(guc);
  }
  
  static void guc_submit_wedged_fini(void *arg)

Hi all,

On Fri, 4 Oct 2024 12:18:00 +1000 Stephen Rothwell <sfr@canb.auug.org.au> wrote:
>
> Today's linux-next merge of the drm-xe tree got a conflict in:
> 
>   drivers/gpu/drm/xe/xe_guc_submit.c
> 
> between commit:
> 
>   9286a191abe2 ("drm/xe: Drop GuC submit_wq pool")
> 
> from the drm-misc-fixes tree and commit:
> 
>   861108666cc0 ("drm/xe: fix UAF around queue destruction")

This is now also commit

  2d2be279f1ca ("drm/xe: fix UAF around queue destruction")

in Linus' tree.

> from the drm-xe tree.
> 
> I fixed it up (see below) and can carry the fix as necessary. This
> is now fixed as far as linux-next is concerned, but any non trivial
> conflicts should be mentioned to your upstream maintainer when your tree
> is submitted for merging.  You may also want to consider cooperating
> with the maintainer of the conflicting tree to minimise any particularly
> complex conflicts.
> 
> diff --cc drivers/gpu/drm/xe/xe_guc_submit.c
> index 17c25f18e286,8a5c21a87977..000000000000
> --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> @@@ -224,11 -224,80 +224,27 @@@ static bool exec_queue_killed_or_banned
>   		 EXEC_QUEUE_STATE_BANNED));
>   }
>   
>  -#ifdef CONFIG_PROVE_LOCKING
>  -static int alloc_submit_wq(struct xe_guc *guc)
>  -{
>  -	int i;
>  -
>  -	for (i = 0; i < NUM_SUBMIT_WQ; ++i) {
>  -		guc->submission_state.submit_wq_pool[i] =
>  -			alloc_ordered_workqueue("submit_wq", 0);
>  -		if (!guc->submission_state.submit_wq_pool[i])
>  -			goto err_free;
>  -	}
>  -
>  -	return 0;
>  -
>  -err_free:
>  -	while (i)
>  -		destroy_workqueue(guc->submission_state.submit_wq_pool[--i]);
>  -
>  -	return -ENOMEM;
>  -}
>  -
>  -static void free_submit_wq(struct xe_guc *guc)
>  -{
>  -	int i;
>  -
>  -	for (i = 0; i < NUM_SUBMIT_WQ; ++i)
>  -		destroy_workqueue(guc->submission_state.submit_wq_pool[i]);
>  -}
>  -
>  -static struct workqueue_struct *get_submit_wq(struct xe_guc *guc)
>  -{
>  -	int idx = guc->submission_state.submit_wq_idx++ % NUM_SUBMIT_WQ;
>  -
>  -	return guc->submission_state.submit_wq_pool[idx];
>  -}
>  -#else
>  -static int alloc_submit_wq(struct xe_guc *guc)
>  -{
>  -	return 0;
>  -}
>  -
>  -static void free_submit_wq(struct xe_guc *guc)
>  -{
>  -
>  -}
>  -
>  -static struct workqueue_struct *get_submit_wq(struct xe_guc *guc)
>  -{
>  -	return NULL;
>  -}
>  -#endif
>  -
> + static void xe_guc_submit_fini(struct xe_guc *guc)
> + {
> + 	struct xe_device *xe = guc_to_xe(guc);
> + 	struct xe_gt *gt = guc_to_gt(guc);
> + 	int ret;
> + 
> + 	ret = wait_event_timeout(guc->submission_state.fini_wq,
> + 				 xa_empty(&guc->submission_state.exec_queue_lookup),
> + 				 HZ * 5);
> + 
> + 	drain_workqueue(xe->destroy_wq);
> + 
> + 	xe_gt_assert(gt, ret);
> + }
> + 
>   static void guc_submit_fini(struct drm_device *drm, void *arg)
>   {
>   	struct xe_guc *guc = arg;
>   
> + 	xe_guc_submit_fini(guc);
>   	xa_destroy(&guc->submission_state.exec_queue_lookup);
>  -	free_submit_wq(guc);
>   }
>   
>   static void guc_submit_wedged_fini(void *arg)

This is now a conflict between the drm-misc-fixes tree and Linus' tree.

-- 
Cheers,
Stephen Rothwell