Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] A TOCTOU race condition between pvr_submit_jobs() and pvr_context_destroy() allows jobs to be pushed to a destroyed scheduler entity, permanently leaking the job, the context, and any associated BOs/fences. -- commit e2ffb23e3856239fee51854e5b7240ef10f40010 Author: Brajesh Gupta <[email protected]> drm/imagination: Fix double call to drm_sched_entity_fini() This commit addresses a use-after-free underflow caused by a double call to drm_sched_entity_fini(). It updates the teardown paths to only clean up the queue entity during a context creation failure. This ensures tearing down contexts does not erroneously finalize the scheduler entity multiple times. > diff --git a/drivers/gpu/drm/imagination/pvr_context.c > b/drivers/gpu/drm/imagination/pvr_context.c > --- a/drivers/gpu/drm/imagination/pvr_context.c > +++ b/drivers/gpu/drm/imagination/pvr_context.c [ ... ] > @@ -384,7 +386,7 @@ pvr_context_release(struct kref *ref_count) > spin_unlock(&pvr_dev->ctx_list_lock); > > xa_erase(&pvr_dev->ctx_ids, ctx->ctx_id); > - pvr_context_destroy_queues(ctx); > + pvr_context_destroy_queues(ctx, false); [Severity: High] This isn't a bug introduced by this patch, but is there a pre-existing race condition between pvr_submit_jobs() and context destruction? If unprivileged userspace calls DRM_IOCTL_PVR_SUBMIT_JOBS and DRM_IOCTL_PVR_DESTROY_CONTEXT concurrently on the same context: 1. pvr_submit_jobs() in drivers/gpu/drm/imagination/pvr_job.c acquires the context reference via pvr_context_lookup() but no synchronization locks are held across the job submission process. 2. Concurrently, pvr_context_destroy() in drivers/gpu/drm/imagination/pvr_context.c removes the context handle and calls pvr_context_kill_queues(), stopping the scheduler entity. 3. pvr_submit_jobs() proceeds and calls drm_sched_entity_push_job(). Since the entity is already stopped, drm_sched_rq_add_entity() returns NULL and does not wake up the scheduler. Does this mean the job and the context (along with associated BOs and fences) are permanently leaked since the job never executes and never drops its context reference? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
