Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] The return value of `drm_sched_entity_init()` is ignored in `etnaviv_open()`, leading to a NULL pointer dereference in `etnaviv_postclose()` if initialization fails. -- --- Patch [1]: [PATCH v3 1/2] drm/etnaviv: Reference count struct etnaviv_file_private --- commit 15b05c3fcbf409d69374c7e633d70b33641f9909 Author: Christian Gmeiner <[email protected]> drm/etnaviv: Reference count struct etnaviv_file_private This commit introduces reference counting for the etnaviv context to prevent a use-after-free when a context is closed while still needed by the GPU reset path. > diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c > b/drivers/gpu/drm/etnaviv/etnaviv_drv.c > index 08aca9035fc1a..a27ed014fb4e7 100644 > --- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c > +++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c [ ... ] > @@ -70,6 +83,8 @@ static int etnaviv_open(struct drm_device *dev, struct > drm_file *file) > if (!ctx) > return -ENOMEM; > > + kref_init(&ctx->refcount); > + > ret = xa_alloc_cyclic(&priv->active_contexts, &ctx->id, ctx, > xa_limit_32b, &priv->next_context_id, GFP_KERNEL); > if (ret < 0) [Severity: High] This is a pre-existing issue, but I noticed the return value of drm_sched_entity_init() is ignored during etnaviv_open(). If drm_sched_entity_init() fails (for example, if memory allocation fails inside drm_sched_entity_stats_new()), it leaves the entity partially initialized with a NULL stats pointer. When the file descriptor is later closed, etnaviv_postclose() unconditionally calls drm_sched_entity_destroy(). Would this sequence result in a crash? etnaviv_open() drm_sched_entity_init(&ctx->sched_entity[i], ...); // Error is ignored etnaviv_postclose() drm_sched_entity_destroy(&ctx->sched_entity[i]); // Leads to drm_sched_entity_stats_put(entity->stats) Does this lead to a NULL pointer dereference when kref_put() operates on the NULL stats pointer? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
