Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
New issues: - [Critical] Calling pm_runtime_dont_use_autosuspend() before pm_runtime_disable() in the probe error path triggers a synchronous runtime suspend, causing a fatal system crash when hardware is subsequently accessed. - [Medium] Calling `pm_runtime_dont_use_autosuspend()` before `pm_runtime_get_sync()` in `panfrost_remove()` causes an unnecessary synchronous suspend followed immediately by a resume. Pre-existing issues: - [High] Missing pm_runtime_put_noidle() at the end of panfrost_remove() permanently leaks the PM usage count on driver unbind. - [High] Premature drm_dev_register() exposes the device before initialization is complete, risking UAF/Data Abort on the error path. -- --- Patch [1]: [PATCH] drm/panfrost: fix autosuspend cleanup during teardown --- commit 20fb0c04bf706e7ac3773cb2ee067fc667a9f893 Author: Guangshuo Li <[email protected]> drm/panfrost: fix autosuspend cleanup during teardown This patch adds missing calls to pm_runtime_dont_use_autosuspend() during the probe error path and panfrost_remove(). It aims to ensure that the autosuspend reference count is properly dropped during device teardown. > diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c > b/drivers/gpu/drm/panfrost/panfrost_drv.c > --- a/drivers/gpu/drm/panfrost/panfrost_drv.c > +++ b/drivers/gpu/drm/panfrost/panfrost_drv.c > @@ -1012,6 +1012,7 @@ static int panfrost_probe(struct platform_device *pdev) > err_out2: > drm_dev_unregister(&pfdev->base); [Severity: High] This is a pre-existing issue, but does registering the device before initializing the shrinker create a race condition here? If panfrost_gem_shrinker_init() fails, the probe aborts and calls drm_dev_unregister(), but this does not revoke open file descriptors. Can userspace race to open the device during this window and then trigger a use-after-free or data abort by accessing torn-down hardware mappings through the open file descriptor? > err_out1: > + pm_runtime_dont_use_autosuspend(pfdev->base.dev); [Severity: Critical] Does placing pm_runtime_dont_use_autosuspend() before pm_runtime_disable() trigger a synchronous suspend? When the usage count is zero, clearing the autosuspend flag causes an immediate idle check which synchronously powers off the hardware. Will the unconditional register accesses in panfrost_device_fini() then cause a fatal data abort since the hardware is already powered off? > pm_runtime_disable(pfdev->base.dev); > panfrost_device_fini(pfdev); [ ... ] > @@ -1026,6 +1027,7 @@ static void panfrost_remove(struct platform_device > *pdev) > drm_dev_unregister(&pfdev->base); > panfrost_gem_shrinker_cleanup(&pfdev->base); > > + pm_runtime_dont_use_autosuspend(pfdev->base.dev); > pm_runtime_get_sync(pfdev->base.dev); [Severity: Medium] Could this sequence cause the hardware to suspend and immediately resume? If the usage count is zero here, pm_runtime_dont_use_autosuspend() will synchronously power off the device. The subsequent pm_runtime_get_sync() will immediately power it back on before hardware teardown. Should the autosuspend cleanup happen after we ensure the device is awake? > pm_runtime_disable(pfdev->base.dev); > panfrost_device_fini(pfdev); [Severity: High] This isn't a bug introduced by this patch, but does this function leak the power management usage count? The call to pm_runtime_get_sync() earlier in the function increments the usage count, but there is no matching pm_runtime_put_noidle() before the function exits. Since the struct device is tied to the platform device and outlives the driver binding, will this permanently break runtime power management by blocking future suspends if the driver is unbound and rebound? -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
