Re: [PATCH v8 13/16] drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-After-Free in IRQ handler during device teardown due to shared interrupt firing after subsystem deinitialization.
--

commit 4af8baef18e17c6d5fb401654ac07ca6918a16ae
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems

This commit skips flushing the GPU caches after a performance counter sample
is made available if the GPU and CPU are fully coherent. It directly signals
the completion instead.

> diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> index ffc77121070e2..b3f71d7fd82a9 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> @@ -52,7 +52,10 @@ void panfrost_perfcnt_clean_cache_done(struct panfrost_device *pfdev)
>  
>  void panfrost_perfcnt_sample_done(struct panfrost_device *pfdev)
>  {
> -	gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES);
> +	if (pfdev->features.selected_coherency != COHERENCY_ACE)
> +		gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES);
> +	else
> +		complete(&pfdev->perfcnt->dump_comp);

[Severity: High]
This is a pre-existing issue, but can this dereference of pfdev->perfcnt lead
to a use-after-free during device teardown?

Looking at panfrost_gpu_init() in drivers/gpu/drm/panfrost/panfrost_gpu.c,
the shared GPU IRQ is requested before panfrost_perfcnt_init() allocates
pfdev->perfcnt. During driver teardown (panfrost_device_fini()), devres
cleans up allocations in reverse order. This means pfdev->perfcnt is freed
while the shared IRQ remains registered.

If an external interrupt fires on the shared IRQ line during this window,
panfrost_gpu_irq_handler() could see the GPU_IRQ_PERFCNT_SAMPLE_COMPLETED
bit set (e.g., if reading GPU_INT_STAT from unclocked hardware returns
0xFFFFFFFF).

The handler would then call panfrost_perfcnt_sample_done(), which accesses
the already freed pfdev->perfcnt pointer here.

Should the GPU IRQ be explicitly disabled or unregistered before perfcnt is
deinitialized?

>  }
>  
>  static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907-claude-fixes-v8-0-c2bcb5e82184@collabora.com?part=13