Re: [PATCH v15 13/15] drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/panfrost: UAF of perfcnt during device unbind
--

commit 1164f77fb530d75cfd2e6bee453335ff4ea53de6
Author: Adrián Larumbe <adrian.larumbe@collabora.com>

drm/panfrost: Avoid cache flush after perfcnt sample in fully coherent systems
    
If the GPU and CPU are fully coherent, then there's no need to flush the
GPU caches after a perfcnt sample is made available.

> diff --git a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> index ffc77121070e2..b3f71d7fd82a9 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_perfcnt.c
> @@ -52,7 +52,10 @@ void panfrost_perfcnt_clean_cache_done(struct panfrost_device *pfdev)
>  
>  void panfrost_perfcnt_sample_done(struct panfrost_device *pfdev)
>  {
> -	gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES);
> +	if (pfdev->features.selected_coherency != COHERENCY_ACE)
> +		gpu_write(pfdev, GPU_CMD, GPU_CMD_CLEAN_CACHES);
> +	else
> +		complete(&pfdev->perfcnt->dump_comp);
                ^^^^^^^^

[Severity: High]
Does this introduce a use-after-free regression during device unbind?

If a user thread calls the perfcnt dump ioctl and blocks in
wait_for_completion_interruptible_timeout() inside
panfrost_perfcnt_dump_locked(), and the device is concurrently unbound:

panfrost_remove() will return without cancelling the wait, and devres cleans
up allocations.

Because devm_kzalloc() for perfcnt in panfrost_perfcnt_init() occurs after
devm_request_irq(), devres frees pfdev->perfcnt while the thread is still
sleeping and the IRQ is still registered.

When the thread wakes up, it will access the freed completion structure.

Additionally, if a shared interrupt fires in this window and GPU_INT_STAT
returns 0xffffffff (because clocks are off), panfrost_perfcnt_sample_done()
will dereference the freed pfdev->perfcnt pointer here.

>  }
>  
>  static int panfrost_perfcnt_dump_locked(struct panfrost_device *pfdev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261012-claude-fixes-v15-0-bc0a6c498553@collabora.com?part=13