Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Use-After-Free in IRQ handler during device teardown due to shared interrupt firing after subsystem deinitialization. -- commit 4af8baef18e17c6d5fb401654ac07ca6918a16ae Author: Adrián Larumbe <[email protected]> drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems This commit skips flushing the GPU caches after a performance counter sample is made available if the GPU and CPU are fully coherent. It directly signals the completion instead. > diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > index ffc77121070e2..b3f71d7fd82a9 100644 > --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > @@ -52,7 +52,10 @@ void panfrost_perfcnt_clean_cache_done(struct > panfrost_device *pfdev) > > void panfrost_perfcnt_sample_done(struct panfrost_device *pfdev) > { > - gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES); > + if (pfdev->features.selected_coherency != COHERENCY_ACE) > + gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES); > + else > + complete(&pfdev->perfcnt->dump_comp); [Severity: High] This is a pre-existing issue, but can this dereference of pfdev->perfcnt lead to a use-after-free during device teardown? Looking at panfrost_gpu_init() in drivers/gpu/drm/panfrost/panfrost_gpu.c, the shared GPU IRQ is requested before panfrost_perfcnt_init() allocates pfdev->perfcnt. During driver teardown (panfrost_device_fini()), devres cleans up allocations in reverse order. This means pfdev->perfcnt is freed while the shared IRQ remains registered. If an external interrupt fires on the shared IRQ line during this window, panfrost_gpu_irq_handler() could see the GPU_IRQ_PERFCNT_SAMPLE_COMPLETED bit set (e.g., if reading GPU_INT_STAT from unclocked hardware returns 0xFFFFFFFF). The handler would then call panfrost_perfcnt_sample_done(), which accesses the already freed pfdev->perfcnt pointer here. Should the GPU IRQ be explicitly disabled or unregistered before perfcnt is deinitialized? > } > > static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev) -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=13
