Re: [PATCH v2 29/33] drm/xe: Add per-device dependency scheduler for IOVA defrag finalize

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] If `xe_dep_scheduler_create()` fails, `xe_bo_defrag_init()` returns early and skips registering the `xe_bo_defrag_fini()` devm action. This leaves the `xe->mem.defrag.worker` active, which can result in a use-after-free when the device struct is freed on probe failure.
--

--- Patch [29]: [PATCH v2 29/33] drm/xe: Add per-device dependency scheduler for IOVA defrag finalize ---
commit 5ebeeff5cf94ad2658593973ac47acd35100efa7
Author: Matthew Brost <matthew.brost@intel.com>
Subject: drm/xe: Add per-device dependency scheduler for IOVA defrag finalize

This patch adds a per-device xe_dep_scheduler dedicated to IOVA defrag
finalize jobs. It initializes this scheduler in xe_bo_defrag_init() and
cleans it up in xe_bo_defrag_fini().

> diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> index f3d76ad9a1050..ec034518e2eae 100644
> --- a/drivers/gpu/drm/xe/xe_bo.c
> +++ b/drivers/gpu/drm/xe/xe_bo.c
[ ... ]
> @@ -1336,6 +1341,16 @@ void xe_bo_defrag_init_early(struct xe_device *xe)
>   */
>  int xe_bo_defrag_init(struct xe_device *xe)
>  {
> +#define XE_BO_MAX_IOVA_DEFRAG_JOBS	16	/* Picking a reasonable value */
> +	struct xe_dep_scheduler *iova_sched;
> +
> +	iova_sched = xe_dep_scheduler_create(xe, NULL, "xe_iova_defrag",
> +					     XE_BO_MAX_IOVA_DEFRAG_JOBS);
> +	if (IS_ERR(iova_sched))
> +		return PTR_ERR(iova_sched);

[Severity: High]
If xe_dep_scheduler_create() fails, returning early here skips the
registration of the xe_bo_defrag_fini() devm action below.

Does this leave the xe->mem.defrag.worker active on this probe error path?
If the worker was already queued during earlier device initialization, it
appears this could result in a use-after-free when the timer fires and the
worker accesses the freed xe_device structure.

> +	xe->mem.defrag.iova_sched = iova_sched;
> +#undef XE_BO_MAX_IOVA_DEFRAG_JOBS
> +
>  	return devm_add_action_or_reset(xe->drm.dev, xe_bo_defrag_fini, xe);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260710215442.2444235-1-matthew.brost@intel.com?part=29