Re: [PATCH v6] drm/imagination: Fix double call to drm_sched_entity_fini()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A TOCTOU race condition between pvr_submit_jobs() and pvr_context_destroy() allows jobs to be pushed to a destroyed scheduler entity, permanently leaking the job, the context, and any associated BOs/fences.
--

commit e2ffb23e3856239fee51854e5b7240ef10f40010
Author: Brajesh Gupta <brajesh.gupta@imgtec.com>

drm/imagination: Fix double call to drm_sched_entity_fini()

This commit addresses a use-after-free underflow caused by a double call to
drm_sched_entity_fini(). It updates the teardown paths to only clean up the
queue entity during a context creation failure. This ensures tearing down
contexts does not erroneously finalize the scheduler entity multiple times.

> diff --git a/drivers/gpu/drm/imagination/pvr_context.c b/drivers/gpu/drm/imagination/pvr_context.c
> --- a/drivers/gpu/drm/imagination/pvr_context.c
> +++ b/drivers/gpu/drm/imagination/pvr_context.c
[ ... ]
> @@ -384,7 +386,7 @@ pvr_context_release(struct kref *ref_count)
>  	spin_unlock(&pvr_dev->ctx_list_lock);
>  
>  	xa_erase(&pvr_dev->ctx_ids, ctx->ctx_id);
> -	pvr_context_destroy_queues(ctx);
> +	pvr_context_destroy_queues(ctx, false);

[Severity: High]
This isn't a bug introduced by this patch, but is there a pre-existing race
condition between pvr_submit_jobs() and context destruction?

If unprivileged userspace calls DRM_IOCTL_PVR_SUBMIT_JOBS and
DRM_IOCTL_PVR_DESTROY_CONTEXT concurrently on the same context:

1. pvr_submit_jobs() in drivers/gpu/drm/imagination/pvr_job.c acquires the
context reference via pvr_context_lookup() but no synchronization locks are
held across the job submission process.

2. Concurrently, pvr_context_destroy() in
drivers/gpu/drm/imagination/pvr_context.c removes the context handle and
calls pvr_context_kill_queues(), stopping the scheduler entity.

3. pvr_submit_jobs() proceeds and calls drm_sched_entity_push_job().

Since the entity is already stopped, drm_sched_rq_add_entity() returns NULL
and does not wake up the scheduler. Does this mean the job and the context
(along with associated BOs and fences) are permanently leaked since the job
never executes and never drops its context reference?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260630-b4-sched_fix-v6-1-afd66a9cabf5@imgtec.com?part=1