Re: [PATCH v2 02/10] drm/ttm: replace TTMs refcount with the DRM refcount v4

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Resurrecting TTM BOs with the unified GEM refcount exposes partially-destroyed zombie objects to xe_drm_client debugfs, leading to a NULL pointer dereference.
--

commit a805e1b4ddde0006d8b373c7aed2f75ce95ec7db
Author: Natalie Vock <nat@pixelcluster.dev>

drm/ttm: replace TTMs refcount with the DRM refcount v4

This commit replaces the separate TTM object reference count with the DRM 
GEM object reference count. This allows the use of drm_exec inside TTM 
and avoids maintaining two reference counts for one object.

> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 3980f376e3ba4..2b470c1746f60 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
[ ... ]
> @@ -246,88 +246,84 @@ static void ttm_bo_delayed_delete(struct work_struct *work)
[ ... ]
> -			kref_init(&bo->kref);
> -			spin_unlock(&bdev->lru_lock);
> +		kref_init(&bo->base.refcount);
> +		bo->base.funcs = &ttm_deleted_object_funcs;
> +		spin_unlock(&bo->bdev->lru_lock);

[Severity: High]
By resurrecting the GEM refcount here to 1, could this expose 
partially-destroyed zombie objects to subsystems like the xe_drm_client?

For example, the client list might still hold the BO, and 
xe_drm_client.c:show_meminfo() attempts to grab a reference:

    if (!kref_get_unless_zero(&bo->ttm.base.refcount))
        continue;

Since the GEM refcount is now resurrected instead of a separate TTM
refcount, this check will succeed on a zombie BO.

If show_meminfo() then acquires the BO's resv lock after the 
ttm_bo_delayed_delete() worker has called ttm_bo_cleanup_memtype_use() 
(which sets bo->resource to NULL), it will dereference the NULL resource 
in bo_meminfo():

    u32 mem_type = bo->ttm.resource->mem_type;

Can this lead to a NULL pointer dereference kernel panic when reading 
the debugfs file?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260706-ttm_2_drm_exec-v2-0-4bf6bfc0d320@pixelcluster.dev?part=2