Re: [PATCH V3 2/3] accel/amdxdna: Fix notifier_wq lifetime race during device removal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Asynchronous work item `amdxdna_hmm_unreg_work` dereferences a potentially freed `vm_area_struct` during MMU notifier release.
--

commit 9bd885c56a90bdf89e66e4a081996397ef692196
Author: Lizhi Hou <lizhi.hou@amd.com>

accel/amdxdna: Fix notifier_wq lifetime race during device removal
    
This commit fixes a use-after-free race during device removal by converting
notifier_wq to use drmm_alloc_ordered_workqueue. This ensures the workqueue
lifetime is managed by DRM and remains valid until resources are released.

> diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
> index 470bf4fc744bf..b943c06a451ef 100644
> --- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
> +++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
[ ... ]
> @@ -389,9 +389,9 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	if (ret)
>  		return ret;
>  
> -	xdna->notifier_wq = alloc_ordered_workqueue("notifier_wq", WQ_MEM_RECLAIM);
> -	if (!xdna->notifier_wq) {
> -		ret = -ENOMEM;
> +	xdna->notifier_wq = drmm_alloc_ordered_workqueue(ddev, "notifier_wq", WQ_MEM_RECLAIM);
> +	if (IS_ERR(xdna->notifier_wq)) {
> +		ret = PTR_ERR(xdna->notifier_wq);

[Severity: High]
This is a pre-existing issue, but can the work items queued to this
workqueue trigger a use-after-free on a vm_area_struct?

Looking at drivers/accel/amdxdna/amdxdna_gem.c, when handling an
MMU_NOTIFY_UNMAP event, the hmm_unreg_work is queued to this notifier_wq
to execute asynchronously. The worker eventually calls amdxdna_umap_release()
which dereferences the vma:

if (is_import_bo(abo) && vma->vm_file && vma->vm_file->f_mapping)
        mapping_clear_unevictable(vma->vm_file->f_mapping);

Since the work item is asynchronous, couldn't the core memory management
subsystem tear down the mapping and free the vm_area_struct before
amdxdna_umap_release() executes, leading to a use-after-free when accessing
vma->vm_file?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611055150.3070216-1-lizhi.hou@amd.com?part=2