Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] If `xe_dep_scheduler_create()` fails, `xe_bo_defrag_init()` returns early and skips registering the `xe_bo_defrag_fini()` devm action. This leaves the `xe->mem.defrag.worker` active, which can result in a use-after-free when the device struct is freed on probe failure. --
--- Patch [29]: [PATCH v2 29/33] drm/xe: Add per-device dependency scheduler for IOVA defrag finalize --- commit 5ebeeff5cf94ad2658593973ac47acd35100efa7 Author: Matthew Brost <[email protected]> Subject: drm/xe: Add per-device dependency scheduler for IOVA defrag finalize This patch adds a per-device xe_dep_scheduler dedicated to IOVA defrag finalize jobs. It initializes this scheduler in xe_bo_defrag_init() and cleans it up in xe_bo_defrag_fini(). > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c > index f3d76ad9a1050..ec034518e2eae 100644 > --- a/drivers/gpu/drm/xe/xe_bo.c > +++ b/drivers/gpu/drm/xe/xe_bo.c [ ... ] > @@ -1336,6 +1341,16 @@ void xe_bo_defrag_init_early(struct xe_device *xe) > */ > int xe_bo_defrag_init(struct xe_device *xe) > { > +#define XE_BO_MAX_IOVA_DEFRAG_JOBS 16 /* Picking a reasonable value */ > + struct xe_dep_scheduler *iova_sched; > + > + iova_sched = xe_dep_scheduler_create(xe, NULL, "xe_iova_defrag", > + XE_BO_MAX_IOVA_DEFRAG_JOBS); > + if (IS_ERR(iova_sched)) > + return PTR_ERR(iova_sched); [Severity: High] If xe_dep_scheduler_create() fails, returning early here skips the registration of the xe_bo_defrag_fini() devm action below. Does this leave the xe->mem.defrag.worker active on this probe error path? If the worker was already queued during earlier device initialization, it appears this could result in a use-after-free when the timer fires and the worker accesses the freed xe_device structure. > + xe->mem.defrag.iova_sched = iova_sched; > +#undef XE_BO_MAX_IOVA_DEFRAG_JOBS > + > return devm_add_action_or_reset(xe->drm.dev, xe_bo_defrag_fini, xe); > } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=29
