Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [Critical] Concurrent execution of i915_perf_add_config_ioctl and i915_perf_unregister can lead to a Use-After-Free of perf->metrics_kobj. -- commit e80590029db9506ad40df9f792adcff0ddb3c4d7 Author: Umesh Nerlige Ramappa <[email protected]> drm/i915/perf: Remove sysfs group on OA config idr_alloc() failure This commit fixes a resource leak where an OA config's sysfs group was not removed if idr_alloc() failed. It adds a new remove_sysfs error path to clean up the sysfs group. > diff --git a/drivers/gpu/drm/i915/i915_perf.c > b/drivers/gpu/drm/i915/i915_perf.c > index 96823dcd3fae2..abda7b1c49569 100644 > --- a/drivers/gpu/drm/i915/i915_perf.c > +++ b/drivers/gpu/drm/i915/i915_perf.c [ ... ] > @@ -4738,6 +4738,8 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, > void *data, > > return id; > > +remove_sysfs: > + sysfs_remove_group(perf->metrics_kobj, &oa_config->sysfs_metric); [Severity: Critical] This is a pre-existing issue, but can this sequence lead to a Use-After-Free of perf->metrics_kobj during a concurrent hardware hot-unplug? If a user-space process repeatedly calls the DRM_IOCTL_I915_PERF_ADD_CONFIG ioctl while the driver is being unbound: CPU1 (Hot-unplug/Unbind) i915_perf_unregister() kobject_put(perf->metrics_kobj); perf->metrics_kobj = NULL; CPU2 (ioctl) i915_perf_add_config_ioctl() // passes early NULL check for perf->metrics_kobj before CPU1 clears it Then CPU2 could eventually reach this newly added error path (or the existing create_dynamic_oa_sysfs_entry() call) and pass the freed perf->metrics_kobj pointer to sysfs_remove_group(), causing a Use-After-Free. Since i915_driver_unregister() calls i915_perf_unregister() before calling drm_dev_unplug(), the DRM core hasn't yet blocked incoming ioctls. Does this lockless teardown of the kobject require synchronization or holding a reference during the ioctl? > sysfs_err: > mutex_unlock(&perf->metrics_lock); > reg_err: -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
