Re: [PATCH] drm/xe/eustall: Fix drm_dev_put called before stream disable in close

[Harish Chegondi <harish.chegondi@intel.com>]

On Wed, Apr 15, 2026 at 10:54:28PM +0000, Shuicheng Lin wrote:
> In xe_eu_stall_stream_close(), drm_dev_put() is called before the
> stream is disabled and its resources are freed. If this drops the
> last reference, the device structures could be freed while the
> subsequent cleanup code still accesses them, leading to a
> use-after-free.
> 
> Fix this by moving drm_dev_put() after all device accesses are
> complete. This matches the ordering in xe_oa_release().
> 
> Fixes: 9a0b11d4cf3b ("drm/xe/eustall: Add support to init, enable and disable EU stall sampling")
> Cc: Harish Chegondi <harish.chegondi@intel.com>
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Shuicheng Lin <shuicheng.lin@intel.com>

Reviewed-by: Harish Chegondi <harish.chegondi@intel.com>

Thanks for the patch!

> ---
>  drivers/gpu/drm/xe/xe_eu_stall.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_eu_stall.c b/drivers/gpu/drm/xe/xe_eu_stall.c
> index aaf3fcc12363..b88b6c49c54a 100644
> --- a/drivers/gpu/drm/xe/xe_eu_stall.c
> +++ b/drivers/gpu/drm/xe/xe_eu_stall.c
> @@ -871,14 +871,14 @@ static int xe_eu_stall_stream_close(struct inode *inode, struct file *file)
>  	struct xe_eu_stall_data_stream *stream = file->private_data;
>  	struct xe_gt *gt = stream->gt;
>  
> -	drm_dev_put(&gt->tile->xe->drm);
> -
>  	mutex_lock(&gt->eu_stall->stream_lock);
>  	xe_eu_stall_disable_locked(stream);
>  	xe_eu_stall_data_buf_destroy(stream);
>  	xe_eu_stall_stream_free(stream);
>  	mutex_unlock(&gt->eu_stall->stream_lock);
>  
> +	drm_dev_put(&gt->tile->xe->drm);
> +
>  	return 0;
>  }
>  
> -- 
> 2.43.0
>