Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Critical] Deterministic double free in rocket_job_close() for multi-core devices. --
--- Patch [2]: [PATCH v4 2/2] drm/rocket: Keep scheduler allocation in rocket_file_priv --- commit 3f1ce60677689fe14af070b96e041b01b9fbc718 Author: Triet Hoang <[email protected]> drm/rocket: Keep scheduler allocation in rocket_file_priv Keep the scheduler allocation in rocket_file_priv and free it unconditionally in rocket_job_close(). Link: https://lore.kernel.org/all/[email protected]/#t [ ... ] > diff --git a/drivers/accel/rocket/rocket_job.c > b/drivers/accel/rocket/rocket_job.c > index adcc792541ec1..ff1d9e802024d 100644 > --- a/drivers/accel/rocket/rocket_job.c > +++ b/drivers/accel/rocket/rocket_job.c [ ... ] > @@ -525,6 +528,7 @@ void rocket_job_close(struct rocket_file_priv > *rocket_priv) > struct drm_sched_entity *entity = &rocket_priv->sched_entity; > > kfree(entity->sched_list); > + kfree(rocket_priv->scheds); [Severity: Critical] Does this cause a double free of the scheds array on multi-core devices? When the device has multiple cores (rdev->num_cores > 1), drm_sched_entity_init() internally assigns the provided scheds array to entity->sched_list. Since the patch additionally saves this same pointer to rocket_priv->scheds, both entity->sched_list and rocket_priv->scheds will point to the exact same heap allocation. By calling kfree() on both sequentially, are we freeing the same memory twice? > drm_sched_entity_destroy(entity); > } > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=2
