Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/panfrost: UAF of perfcnt during device unbind --
commit 1164f77fb530d75cfd2e6bee453335ff4ea53de6 Author: Adrián Larumbe <[email protected]> drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems If the GPU and CPU are fully coherent, then there's no need to flush the GPU caches after a perfcnt sample is made available. > diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > index ffc77121070e2..b3f71d7fd82a9 100644 > --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c > @@ -52,7 +52,10 @@ void panfrost_perfcnt_clean_cache_done(struct > panfrost_device *pfdev) > > void panfrost_perfcnt_sample_done(struct panfrost_device *pfdev) > { > - gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES); > + if (pfdev->features.selected_coherency != COHERENCY_ACE) > + gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES); > + else > + complete(&pfdev->perfcnt->dump_comp); ^^^^^^^^ [Severity: High] Does this introduce a use-after-free regression during device unbind? If a user thread calls the perfcnt dump ioctl and blocks in wait_for_completion_interruptible_timeout() inside panfrost_perfcnt_dump_locked(), and the device is concurrently unbound: panfrost_remove() will return without cancelling the wait, and devres cleans up allocations. Because devm_kzalloc() for perfcnt in panfrost_perfcnt_init() occurs after devm_request_irq(), devres frees pfdev->perfcnt while the thread is still sleeping and the IRQ is still registered. When the thread wakes up, it will access the freed completion structure. Additionally, if a shared interrupt fires in this window and GPU_INT_STAT returns 0xffffffff (because clocks are off), panfrost_perfcnt_sample_done() will dereference the freed pfdev->perfcnt pointer here. > } > > static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev) -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=13
