On 5/23/2026 1:32 AM, Shuvam Pandey wrote:
qaic_perf_stats_bo_ioctl() validates each BO by checking bo->sliced and bo->dbc before returning its perf stats. These fields are changed by the detach paths while holding bo->lock, but the perf stats ioctl reads them without that lock.A concurrent detach can clear bo->dbc and mark the BO unsliced while the perf stats ioctl is validating the BO. Take bo->lock while checking the BO state and copying the per-BO stats into the temporary result buffer. Fixes: 4ddf4ddfceb4 ("accel/qaic: Ensure entry belongs to DBC in qaic_perf_stats_bo_ioctl()") Signed-off-by: Shuvam Pandey <[email protected]>
Reviewed-by: Jeff Hugo <[email protected]> Pushed to drm-misc-next. -Jeff
