Re: [PATCH v7 4/6] drm/ttm: Hook up a cgroup-aware reclaim callback for the dmem controller

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] `ttm_resource_manager_set_dmem_region()` fails to clear the cgroup region pointer when passed `NULL`, leaving a dangling pointer that can cause a use-after-free.
--

commit 02822c8c1770f6a971fca6d0ddb57472d4eea596
Author: Thomas Hellström <thomas.hellstrom@linux.intel.com>

drm/ttm: Hook up a cgroup-aware reclaim callback for the dmem controller

This commit introduces functionality to evict buffer objects charged to a
specific dmem cgroup pool from a resource manager's LRU. It adds
ttm_resource_manager_set_dmem_region() to associate a dmem cgroup region
with a resource manager, and provides a reclaim callback that drivers can
wire up to TTM eviction.

> diff --git a/drivers/gpu/drm/ttm/ttm_resource.c b/drivers/gpu/drm/ttm/ttm_resource.c
> index 154d6739256f8..ad00723e99ef1 100644
> --- a/drivers/gpu/drm/ttm/ttm_resource.c
> +++ b/drivers/gpu/drm/ttm/ttm_resource.c

[ ... ]

> +void ttm_resource_manager_set_dmem_region(struct ttm_resource_manager *man,
> +					  struct dmem_cgroup_region *region)
> +{
> +	if (!IS_ERR_OR_NULL(region))
> +		man->cg = region;
> +}
> +EXPORT_SYMBOL(ttm_resource_manager_set_dmem_region);

[Severity: High]
The v5 changelog mentions handling a NULL region here to clear the reclaim
callback and prevent use-after-free bugs. However, if region is NULL,
!IS_ERR_OR_NULL(region) evaluates to false. 

Does this skip the assignment and fail to clear man->cg, leaving a dangling
pointer if a driver tries to detach the region before teardown?

Should this code check !IS_ERR(region) instead, or unconditionally assign
man->cg = NULL when the passed region is NULL?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260703130541.2686-1-thomas.hellstrom@linux.intel.com?part=4