Re: [PATCH] accel/ivpu: Use separate flag for job timeout

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [High] Premature clearing of `job_timeout_detected` flag before flushing `context_abort_work` silently drops the ban on the guilty context during a job timeout (TDR).

Pre-existing issues:
- [High] Lockless `xa_load` of `file_priv` in the MMU event queue IRQ handler leads to a Use-After-Free.
--

commit b8245a180aec634640c11be76ef2b20b2a900039
Author: Jakub Pawlak <jakub.pawlak@intel.com>

accel/ivpu: Use separate flag for job timeout

This patch introduces a separate flag, job_timeout_detected, to distinguish
engine resets caused by job timeouts from other reasons. The flag is
cleared in ivpu_prepare_for_reset() to ensure a clean state after recovery.

> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 0f215392d42de..647684219e9d3 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
> @@ -528,6 +528,7 @@ void ivpu_prepare_for_reset(struct ivpu_device *vdev)
>  {
>  	ivpu_hw_irq_disable(vdev);
>  	disable_irq(vdev->irq);
> +	atomic_set(&vdev->job_timeout_detected, 0);
>  	flush_work(&vdev->irq_dct_work);
>  	flush_work(&vdev->context_abort_work);

[Severity: High]
Is it safe to clear the job_timeout_detected flag before flushing
context_abort_work?

If a concurrent recovery calls ivpu_prepare_for_reset() and sets the flag
to 0, and context_abort_work runs simultaneously, could it reach the
atomic_cmpxchg() in reset_engine_and_mark_faulty_contexts(), see a 0, and
silently skip banning the guilty context? 

Should this flag be cleared after flushing the work queues instead?

[ ... ]

> diff --git a/drivers/accel/ivpu/ivpu_job.c b/drivers/accel/ivpu/ivpu_job.c
> index b3de5dd29d1e8..084d825f744dd 100644
> --- a/drivers/accel/ivpu/ivpu_job.c
> +++ b/drivers/accel/ivpu/ivpu_job.c
[ ... ]
> @@ -1260,10 +1259,10 @@ static int reset_engine_and_mark_faulty_contexts(struct ivpu_device *vdev)
>  		return ret;
>  
>  	/*
> -	 * If faults are detected, ignore guilty contexts from engine reset as NPU may not be stuck
> -	 * and could return currently running good context and faulty contexts are already marked
> +	 * If job timeout is detected, read guilty context from engine reset, for other reasons
> +	 * faulty context is already known
>  	 */
> -	if (atomic_cmpxchg(&vdev->faults_detected, 1, 0) == 1)
> +	if (atomic_cmpxchg(&vdev->job_timeout_detected, 1, 0) == 0)
>  		return 0;
>  
>  	num_impacted_contexts = resp.payload.engine_reset_done.num_impacted_contexts;

[ ... ]

> diff --git a/drivers/accel/ivpu/ivpu_mmu.c b/drivers/accel/ivpu/ivpu_mmu.c
> index 41efd8985fa67..b2025274f91de 100644
> --- a/drivers/accel/ivpu/ivpu_mmu.c
> +++ b/drivers/accel/ivpu/ivpu_mmu.c
> @@ -964,7 +964,6 @@ void ivpu_mmu_irq_evtq_handler(struct ivpu_device *vdev)
>  		file_priv = xa_load(&vdev->context_xa, ssid);
>  		if (file_priv) {
>  			if (!READ_ONCE(file_priv->has_mmu_faults)) {
> -				atomic_set(&vdev->faults_detected, 1);
>  				ivpu_mmu_dump_event(vdev, event);
>  				WRITE_ONCE(file_priv->has_mmu_faults, true);
>  			}

[Severity: High]
This is a pre-existing issue, but does the lockless xa_load() here risk a
use-after-free?

Looking at file_priv_release() in drivers/accel/ivpu/ivpu_drv.c, file_priv
is freed immediately via kfree() without waiting for an RCU grace period
after being removed from the xarray:

drivers/accel/ivpu/ivpu_drv.c:file_priv_release() {
    ...
    ivpu_user_limits_put(vdev, file_priv->user_limits);
    mutex_destroy(&file_priv->ms_lock);
    mutex_destroy(&file_priv->lock);
    kfree(file_priv);
}

If a user closes the file descriptor concurrently with this IRQ handler,
could file_priv be freed while we are still accessing
file_priv->has_mmu_faults via READ_ONCE() or WRITE_ONCE()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914082800.892044-1-karol.wachowski@linux.intel.com?part=1