Re: [PATCH v6 1/2] tests/intel: Add gem_change_handle_race test suite

[Tvrtko Ursulin <tursulin@ursulin.net>]

On 02/09/2026 02:03, vitaly.prosyak@amd.com wrote:
> From: Vitaly Prosyak <vitaly.prosyak@amd.com>
> 
> Add a GPU-agnostic GEM_CHANGE_HANDLE race-test suite covering concurrent
> handle changes, object invalidation, randomized offsets, VMAs, PPGTTs, and
> object/context contention in execbuf paths.
> 
> GEM_CHANGE_HANDLE is currently wired to drm_invalid_op in DRM core. This IGT
> coverage is a prerequisite for validating the eventual kernel-side ioctl
> implementation and makes fixing its security bugs safer.
> 
> Cc: Kamil Konieczny <kamil.konieczny@linux.intel.com>
> Cc: Sebastian Brzezinka <sebastian.brzezinka@intel.com>
> Cc: Christian Konig <christian.koenig@amd.com>
> Cc: Simona Vetter <simona@ffwll.ch>
> Cc: Alex Deucher <alexander.deucher@amd.com>
> Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
> ---
>   tests/intel/gem_change_handle_race.c | 1850 ++++++++++++++++++++++++++
>   tests/meson.build                    |    1 +
>   2 files changed, 1851 insertions(+)
>   create mode 100644 tests/intel/gem_change_handle_race.c
> 
> diff --git a/tests/intel/gem_change_handle_race.c b/tests/intel/gem_change_handle_race.c
> new file mode 100644
> index 000000000..6aff590b8
> --- /dev/null
> +++ b/tests/intel/gem_change_handle_race.c
> @@ -0,0 +1,1850 @@
> +// SPDX-License-Identifier: MIT
> +/*
> + * Copyright 2026 Advanced Micro Devices, Inc.
> + * Copyright 2026 Intel Corporation
> + *
> + * GPU-agnostic race condition tests for GEM_CHANGE_HANDLE ioctl
> + *
> + * NOTE: This test is located in tests/intel/ directory because:
> + * 1. All gem_* tests are traditionally placed in tests/intel/ regardless
> + *    of GPU vendor, following IGT convention for GEM-related tests
> + * 2. The test uses i915/gem.h and i915/gem_create.h for GEM object creation
> + *    on Intel platforms, though it works vendor-agnostically via DRM core
> + * 3. Some subtest designs (noop-same-handle, invalid-*, edge-*, functional-*)
> + *    were proposed by Simona Vetter (Intel), hence Intel copyright header
> + *
> + * ARM compatibility: This test uses pthread_setaffinity_np() which requires
> + * _GNU_SOURCE and may behave differently on ARM due to different CPU topology.
> + * The test gracefully handles CPU pinning failures and continues execution.
> + * SUBTEST: object invalid race to random offsets
> + * Description: Validate race behavior when object handles are invalidated while
> + *              offsets are queried with randomized access patterns.
> + *
> +
> + */
> +
> +#include <errno.h>
> +#include <fcntl.h>
> +#include <limits.h>
> +#include <pthread.h>
> +#include <sched.h>
> +#include <semaphore.h>
> +#include <signal.h>
> +#include <string.h>
> +#include <sys/stat.h>
> +
> +#include "igt.h"
> +#include "igt_device.h"
> +#include "i915/gem.h"
> +#include "i915/gem_create.h"
> +
> +/* AMDGPU includes (if available) */
> +#if __has_include("igt_amd.h")

In upstream it is there no?

> +#include "lib/amdgpu/amd_memory.h"
> +#include "igt_amd.h"
> +#define HAS_AMDGPU 1
> +#else
> +#define HAS_AMDGPU 0
> +#endif
> +
> +static inline void gem_change_handle_wait(void)
> +{
> +	sched_yield();
> +}

Feels misleading to hide sched_yield into a helper with a wait in its 
name. Given there are only two callers I would just make them call 
sched_yield() directly.

> +
> +/* Helper to check for concurrent access traces in kernel log */
> +static void require_dmesg_access(void)
> +{
> +	FILE *fp;
> +	char line[64];
> +
> +	fp = popen("dmesg | grep -m 1 . 2>/dev/null", "r");
> +	igt_require_f(fp, "dmesg is not accessible; skipping tests that validate via dmesg\n");
> +	igt_require_f(fgets(line, sizeof(line), fp),
> +		      "dmesg appears inaccessible; skipping tests that validate via dmesg\n");
> +	pclose(fp);
> +}
> +
> +static int check_kernel_traces(void)
> +{
> +	FILE *fp;
> +	char line[1024];
> +	int trace_count = 0;
> +
> +	/*
> +	 * concurrent access manifests in kernel logs as:
> +	 * - KASAN reports (if CONFIG_KASAN=y)
> +	 * - Kernel oops/warnings in drm_gem_object_release_handle
> +	 * - Stack traces with drm_gem_object_handle_put_unlocked
> +	 *
> +	 * We grep for function names that appear in the concurrent access path.
> +	 */
> +	fp = popen("dmesg | grep -c -E '(KASAN.*(drm_gem|change_handle)|"
> +		   "drm_gem_object_release_handle|"
> +		   "drm_gem_object_handle_put_unlocked|"
> +		   "drm_gem_change_handle.*RIP)' 2>/dev/null", "r");
> +	if (!fp)
> +		return 0;
> +
> +	if (fgets(line, sizeof(line), fp))
> +		trace_count = atoi(line);
> +	pclose(fp);
> +
> +	return trace_count;
> +}
> +
> +static void pin_to_cpu(int cpu)
> +{
> +	cpu_set_t cpuset;
> +	int ret;
> +
> +	CPU_ZERO(&cpuset);
> +	CPU_SET(cpu, &cpuset);
> +	ret = pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset);
> +
> +	/*
> +	 * ARM compatibility: pthread_setaffinity_np() may fail on ARM systems
> +	 * due to different CPU topology or when running in containers/VMs.
> +	 * We don't fail the test - CPU pinning is a best-effort optimization
> +	 * to increase race condition probability, not a hard requirement.
> +	 */
> +	if (ret != 0)
> +		igt_debug("Failed to pin to CPU %d (errno=%d), continuing anyway\n",
> +			  cpu, ret);
> +}
> +
> +/* Define DRM_IOCTL_GEM_CHANGE_HANDLE if not available in kernel headers */
> +#ifndef DRM_IOCTL_GEM_CHANGE_HANDLE
> +struct drm_gem_change_handle {
> +	__u32 handle;
> +	__u32 new_handle;
> +};
> +
> +#define DRM_IOCTL_GEM_CHANGE_HANDLE    DRM_IOWR(0xD2, struct drm_gem_change_handle)
> +#endif

It is available in upstream so you can drop it.

> +
> +/**
> + * TEST: gem change handle race
> + * Description: Multi-threaded race condition tests for GEM_CHANGE_HANDLE
> + * Category: Core
> + * Mega feature: General Core features
> + * Sub-category: GEM handles
> + * Functionality: gem change handle
> + * Feature: gem
> + * Run type: FULL
> + *
> + * SUBTEST: race-close-before-lock
> + * Description: GEM_CLOSE before CHANGE_HANDLE table_lock (concurrent access)
> + *
> + * SUBTEST: race-change-vs-close
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-change-vs-prime
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-exploit-single-thread
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-close-before-lock
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> +
> + * SUBTEST: race-change-vs-close
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-change-vs-change
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-change-vs-prime
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-aggressive-change-vs-close
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-exploit-single-thread
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-exploit-random-handles
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> + * SUBTEST: race-close-before-lock
> + * Description: Validate subtest behavior and race handling for this scenario.
> + *
> +
> + */
> +
> +IGT_TEST_DESCRIPTION("Multi-threaded race condition tests for GEM_CHANGE_HANDLE");
> +
> +#define BO_SIZE (16 * 1024)
> +#define RACE_DURATION_SEC 1
> +
> +/* Verbose logging - set to false to reduce output */
> +static bool verbose_logging;
> +
> +/* Driver type detection */
> +enum gpu_driver {
> +	DRIVER_TYPE_UNKNOWN = 0,
> +	DRIVER_TYPE_I915,
> +	DRIVER_TYPE_AMDGPU,
> +};
> +
> +/* GPU context structure */
> +struct gpu_ctx {
> +	int fd;
> +	enum gpu_driver driver;
> +#if HAS_AMDGPU
> +	amdgpu_device_handle amdgpu_device;
> +#endif
> +};

This is interesting because recently Cascardo was proposing to add a 
driver agnostic buffer allocation. Look for a patch titled "lib/xe: 
Introduce dmem driver and implement Xe support". I wonder it two could 
be merged into something which works for both but I guess it can be 
follow up work as well.

Btw is the amdgpu_device needed? I don't see it used in the series 
unless I am missing something.

> +/* Thread synchronization */
> +struct thread_data {
> +	struct gpu_ctx *ctx;
> +	uint32_t handle;
> +	uint32_t alt_handle;
> +	uint32_t *race_detected;
> +	int *unexpected_errno;  /* Track what errno caused the race */
> +	bool running;
> +	pthread_barrier_t *barrier;
> +};
> +
> +struct aggressive_data {
> +	struct gpu_ctx *ctx;
> +	int go;
> +	uint32_t handle;
> +	uint32_t new_handle;
> +};
> +
> +struct single_thread_data {
> +	struct gpu_ctx *ctx;
> +	int *main_fd;
> +	pthread_mutex_t *fd_lock;
> +	bool running;
> +	bool hammer_ready;  /* Signal when BO created */
> +	uint32_t swap_count;
> +	uint32_t close_count;
> +	uint32_t *race_hits;
> +	pthread_barrier_t *barrier;
> +};
> +
> +struct random_handle_data {
> +	struct gpu_ctx *ctx;
> +	int *main_fd;
> +	pthread_mutex_t *fd_lock;
> +	bool running;
> +	bool hammer_ready;
> +	uint32_t swap_count;
> +	uint32_t close_count;
> +	uint32_t attempt_count;  /* Track total attempts */
> +	uint32_t *race_hits;
> +	pthread_barrier_t *barrier;
> +};
> +
> +struct race_shared {
> +	int fd;
> +	uint32_t old_handle;
> +	uint32_t new_handle;
> +	struct drm_gem_change_handle ch;
> +	struct drm_gem_close cl;
> +	sem_t change_sem;
> +	sem_t close_sem;
> +	int change_success;
> +	int close_success;
> +};
> +
> +static enum gpu_driver detect_driver(int fd)
> +{
> +	/* Check AMDGPU first (primary target) */
> +	if (is_amdgpu_device(fd))
> +		return DRIVER_TYPE_AMDGPU;
> +	if (is_i915_device(fd))
> +		return DRIVER_TYPE_I915;
> +	return DRIVER_TYPE_UNKNOWN;
> +}
> +
> +static const char *gpu_name(enum gpu_driver driver)
> +{
> +	switch (driver) {
> +	case DRIVER_TYPE_I915: return "Intel i915";
> +	case DRIVER_TYPE_AMDGPU: return "AMD GPU";
> +	default: return "Unknown";
> +	}
> +}
> +
> +static uint32_t gem_create_bo(struct gpu_ctx *ctx, uint64_t size)
> +{
> +	uint32_t handle = 0;
> +
> +	switch (ctx->driver) {
> +	case DRIVER_TYPE_I915: {
> +		struct drm_i915_gem_create create = { .size = size };
> +
> +		do_ioctl(ctx->fd, DRM_IOCTL_I915_GEM_CREATE, &create);
> +		handle = create.handle;
> +		break;
> +	}
> +	case DRIVER_TYPE_AMDGPU:
> +#if HAS_AMDGPU
> +		handle = igt_amd_create_bo(ctx->fd, size);
> +#else
> +		igt_require_f(0, "AMDGPU support not compiled in\n");

Isn't HAS_AMDGPU defined based on the header file presence, not the 
build configuration?

> +#endif
> +		break;
> +	default:
> +		igt_assert_f(0, "Unsupported driver\n");
> +	}
> +
> +	igt_assert(handle != 0);
> +	return handle;
> +}
> +
> +static int gem_close_bo(struct gpu_ctx *ctx, uint32_t handle)
> +{
> +	struct drm_gem_close close_args = { .handle = handle };
> +
> +	return igt_ioctl(ctx->fd, DRM_IOCTL_GEM_CLOSE, &close_args);
> +}
> +
> +static int gem_change_handle(struct gpu_ctx *ctx, uint32_t old_handle, uint32_t new_handle)
> +{
> +	struct drm_gem_change_handle args = {
> +		.handle = old_handle,
> +		.new_handle = new_handle,
> +	};
> +	return igt_ioctl(ctx->fd, DRM_IOCTL_GEM_CHANGE_HANDLE, &args);
> +}
> +
> +/*
> + * =======================================================================
> + * RACE CONDITION #1: CHANGE_HANDLE vs GEM_CLOSE
> + * =======================================================================
> + *
> + *
> + * Thread A (CHANGE_HANDLE)           Thread B (GEM_CLOSE)
> + * ------------------------           --------------------
> + * 1. Lookup handle 0x100
> + *    -> Find GEM object
> + *                                     2. Lookup handle 0x100
> + *                                        -> Find GEM object
> + *                                     3. Remove from handle table
> + *                                     4. Free GEM object
> + * 5. Change handle 0x100 -> 0x200
> + *    -> Operate on freed memory! !
> + *
> + * Test validates kernel properly locks to prevent concurrent access issues.
> + */
> +
> +static void *change_handle_thread(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	uint32_t handle = data->handle;
> +	uint32_t new_handle = data->alt_handle;
> +	int ret;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		ret = gem_change_handle(data->ctx, handle, new_handle);
> +		if (ret == 0) {
> +			/* Successfully changed - try to change back */
> +			ret = gem_change_handle(data->ctx, new_handle, handle);

It should be possible to fold this into a single call to 
gem_change_handle if each iteration simply swaps new_handle and handle. 
That way you could have a single list of expected errnos etc.

> +			if (ret != 0 && errno != ENOENT && errno != EINVAL &&
> +			    errno != EEXIST && errno != ENOSPC) {
> +				/* Unexpected error - potential race */
> +				*data->unexpected_errno = errno;
> +				__sync_fetch_and_add(data->race_detected, 1);
> +			}
> +		} else if (errno != ENOENT && errno != EINVAL &&
> +		   errno != EEXIST && errno != ENOSPC) {
> +			/*
> +			 * Expected errors:
> +			 * - ENOENT: handle was closed
> +			 * - EINVAL: invalid handle
> +			 * - EEXIST: target handle already exists (collision detected early)
> +			 * - ENOSPC: target handle occupied (collision detected during idr_alloc)

The list of possible errors is a bit odd to me.

1)
What is the difference between invalid handle and a closed handle from 
userspace point of view?

2)
ENOSPC reads completely misleading - is the kernel side implementation 
sane? Why would userspace care to know the difference between EEXIST and 
ENOSPC?

> +			 */
> +			*data->unexpected_errno = errno;
> +			__sync_fetch_and_add(data->race_detected, 1);
> +		}
 > +		sched_yield();

Worry here is sched_yield() is documented as the suspicious thing to use 
with normal scheduling policies. How effective was it at hitting the race?

> +	}
> +
> +	return NULL;
> +}
> +
> +static void *close_recreate_thread(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	uint32_t handle;
> +	uint32_t old_handle;
> +	pthread_t tid = pthread_self();
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/* Close the handle */
> +		old_handle = data->handle;
> +		if (data->handle) {
> +			gem_close_bo(data->ctx, data->handle);

This may either succeed or fail, right?

> +			if (verbose_logging) {
> +				igt_info("[CLOSE-TID:%lu] Closed handle %u\n",
> +					 (unsigned long)tid, old_handle);
> +			}
> +		}

If old_handle is used only for debug, but data->handle is also not 
modified, you should either use the cached local more or not at all. 
Like this it is confusing to read.

> +
> +		/* Recreate BO with new handle */
> +		handle = gem_create_bo(data->ctx, BO_SIZE);

I guess here the expectation is allocated handle is equal to one of the 
two handles?

[comes back later]

Hm, or not. Rename is from handle to handle + 0x1000, so this allocation 
can result in a handle+1, so three unique handles can be in play? If it 
does result in handle+1 the renaming thread will never try to touch it 
though.

> +		data->handle = handle;
> +		if (verbose_logging) {
> +			igt_info("[CLOSE-TID:%lu] Created new BO with handle %u\n",
> +				 (unsigned long)tid, handle);
> +		}
> +
> +		sched_yield();
> +	}
> +
> +	return NULL;
> +}
> +
> +/**
> + * test_race_change_vs_close - Race CHANGE_HANDLE against GEM_CLOSE
> + *
> + *
> + * Spawns two threads:
> + * - Thread A: Continuously changes handle value
> + * - Thread B: Continuously closes and recreates handle
> + *
> + * Validates kernel prevents concurrent access issues through proper locking.
> + */
> +static void test_race_change_vs_close(struct gpu_ctx *ctx)
> +{
> +	pthread_t thread_change, thread_close;
> +	pthread_barrier_t barrier;
> +	struct thread_data data = {0};
> +	uint32_t race_detected = 0;
> +	int unexpected_errno = 0;
> +	uint32_t handle;
> +
> +	igt_info("Testing RACE #1: CHANGE_HANDLE vs CLOSE on %s\n",
> +		 gpu_name(ctx->driver));
> +	igt_info("  Duration: %d seconds\n", RACE_DURATION_SEC);
> +	igt_info("  Goal: Detect concurrent access issues scenarios\n");

The logs feel atypical for an IGT test and I suggest to drop them.

> +
> +	handle = gem_create_bo(ctx, BO_SIZE);
> +	igt_assert(handle != 0);
> +
> +	data.ctx = ctx;
> +	data.handle = handle;
> +	data.alt_handle = handle + 0x1000;
> +	data.race_detected = &race_detected;
> +	data.unexpected_errno = &unexpected_errno;

Do these two need to be pointers or they could be embdedded in data just 
as well?

> +	__atomic_store_n(&data.running, true, __ATOMIC_RELEASE);
> +
> +	pthread_barrier_init(&barrier, NULL, 2);
> +	data.barrier = &barrier;
> +
> +	/* Start both threads simultaneously */
> +	igt_assert_eq(pthread_create(&thread_change, NULL, change_handle_thread, &data), 0);
> +	igt_assert_eq(pthread_create(&thread_close, NULL, close_recreate_thread, &data), 0);
> +
> +	/* Let them race */
> +	sleep(RACE_DURATION_SEC);
> +
> +	__atomic_store_n(&data.running, false, __ATOMIC_RELEASE);
> +	pthread_join(thread_change, NULL);
> +	pthread_join(thread_close, NULL);
> +
> +	pthread_barrier_destroy(&barrier);
> +
> +	/* Clean up final handle if exists */
> +	if (data.handle)
> +		gem_close_bo(ctx, data.handle);

100% only one handle to clean up?

> +
> +	igt_info("  Race test completed. Suspicious conditions: %u\n", race_detected);
> +	if (race_detected > 0) {
> +		igt_info("  ***  RACE DETECTED: Unexpected errno = %d (%s)\n",
> +			 unexpected_errno, strerror(unexpected_errno));
> +		igt_info("  This indicates the kernel may not be properly handling concurrent\n");
> +		igt_info("  CHANGE_HANDLE operations. Kernel should serialize these with\n");
> +		igt_info("  proper locking to prevent corruption and concurrent access issues.\n");
> +	}
> +	igt_assert_f(race_detected == 0,
> +		     "Race condition detected! errno=%d (%s). "
> +		     "Kernel locking may be insufficient.\n",
> +		     unexpected_errno, strerror(unexpected_errno));

IMO the last assert has enough logging and I would just remove the 
preceding igt_info lines since they look redundant.

> +}
> +
> +/*
> + * =======================================================================
> + * RACE CONDITION #2: CHANGE_HANDLE vs CHANGE_HANDLE
> + * =======================================================================
> + *
> + *
> + * "I'd just spawn two threads, that constantly try to change the handle
> + *  between just 2 back and forth, to maximize the amount of conflicts"
> + *
> + * Thread A: change_handle(H, H+1)
> + * Thread B: change_handle(H+1, H)
> + * ... continuously swapping ...
> + *
> + * Tests handle table corruption, reference counting, lost handles.
> + */
> +
> +static void *change_handle_thread_a(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	int ret;
> +	pthread_t tid = pthread_self();
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		ret = gem_change_handle(data->ctx, data->handle, data->alt_handle);
> +		if (verbose_logging) {
> +			if (ret == 0) {
> +				igt_info("[THREAD-A-TID:%lu] %u -> %u: SUCCESS\n",
> +					 (unsigned long)tid, data->handle, data->alt_handle);
> +			} else {
> +				igt_info("[THREAD-A-TID:%lu] %u -> %u: FAILED - %s (errno=%d)\n",
> +					 (unsigned long)tid, data->handle, data->alt_handle,
> +					 strerror(errno), errno);
> +			}
> +		}
> +
> +		if (ret != 0 && errno != ENOENT && errno != EINVAL &&
> +		    errno != EEXIST && errno != ENOSPC) {
> +			/* Unexpected error - potential race */
> +			igt_info("[THREAD-A-TID:%lu] *** UNEXPECTED ERROR: %s (errno=%d) ***\n",
> +				 (unsigned long)tid, strerror(errno), errno);
> +			*data->unexpected_errno = errno;
> +			__sync_fetch_and_add(data->race_detected, 1);
> +		}
> +		sched_yield();
> +	}
> +
> +	return NULL;
> +}
> +
> +static void *change_handle_thread_b(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	int ret;
> +	pthread_t tid = pthread_self();
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		ret = gem_change_handle(data->ctx, data->alt_handle, data->handle);
> +		if (verbose_logging) {
> +			if (ret == 0) {
> +				igt_info("[THREAD-B-TID:%lu] %u -> %u: SUCCESS\n",
> +					 (unsigned long)tid, data->alt_handle, data->handle);
> +			} else {
> +				igt_info("[THREAD-B-TID:%lu] %u -> %u: FAILED - %s (errno=%d)\n",
> +					 (unsigned long)tid, data->alt_handle, data->handle,
> +					 strerror(errno), errno);
> +			}
> +		}
> +
> +		if (ret != 0 && errno != ENOENT && errno != EINVAL &&
> +		    errno != EEXIST && errno != ENOSPC) {
> +			/* Unexpected error */
> +			igt_info("[THREAD-B-TID:%lu] *** UNEXPECTED ERROR: %s (errno=%d) ***\n",
> +				 (unsigned long)tid, strerror(errno), errno);
> +			*data->unexpected_errno = errno;
> +			__sync_fetch_and_add(data->race_detected, 1);
> +		}
> +		sched_yield();
> +	}
> +
> +	return NULL;
> +}

Aren't change_handle_thread_a and change_handle_thread_b identical? 
Pretty sure you could achieve the same coverage by using swap() in a 
loop and a single function.

> +
> +/**
> + * test_race_change_vs_change - Concurrent CHANGE_HANDLE operations
> + *
> + *
> + * Implements email thread test strategy:
> + * "spawn two threads that constantly try to change the handle between
> + *  just 2 back and forth, to maximize the amount of conflicts"
> + *
> + * Thread A: change(H, H+1)
> + * Thread B: change(H+1, H)
> + *
> + * Validates kernel prevents handle table corruption.
> + */
> +static void test_race_change_vs_change(struct gpu_ctx *ctx)
> +{
> +	pthread_t thread_a, thread_b;
> +	pthread_barrier_t barrier;
> +	struct thread_data data = {0};
> +	uint32_t race_detected = 0;
> +	int unexpected_errno = 0;
> +	uint32_t handle;
> +
> +	igt_info("Testing RACE #2: CHANGE_HANDLE vs CHANGE_HANDLE on %s\n",
> +		 gpu_name(ctx->driver));
> +	igt_info("  Duration: %d seconds\n", RACE_DURATION_SEC);
> +	igt_info("  Strategy: Two threads swapping handle H <-> H+1\n");
> +	igt_info("  Goal: Detect handle corruption and lost handles\n");
> +
> +	handle = gem_create_bo(ctx, BO_SIZE);
> +	igt_assert(handle != 0);
> +
> +	data.ctx = ctx;
> +	data.handle = handle;
> +	data.alt_handle = handle + 1;
> +	data.race_detected = &race_detected;
> +	data.unexpected_errno = &unexpected_errno;
> +	__atomic_store_n(&data.running, true, __ATOMIC_RELEASE);
> +
> +	pthread_barrier_init(&barrier, NULL, 2);
> +	data.barrier = &barrier;
> +
> +	/* Start both threads simultaneously */
> +	igt_assert_eq(pthread_create(&thread_a, NULL, change_handle_thread_a, &data), 0);
> +	igt_assert_eq(pthread_create(&thread_b, NULL, change_handle_thread_b, &data), 0);
> +
> +	/* Let them race */
> +	sleep(RACE_DURATION_SEC);
> +
> +	__atomic_store_n(&data.running, false, __ATOMIC_RELEASE);
> +	pthread_join(thread_a, NULL);
> +	pthread_join(thread_b, NULL);
> +
> +	pthread_barrier_destroy(&barrier);
> +
> +	/* Try to close both possible handles */
> +	gem_close_bo(ctx, handle);
> +	gem_close_bo(ctx, handle + 1);
> +
> +	igt_info("  Race test completed. Suspicious conditions: %u\n", race_detected);
> +	if (race_detected > 0) {
> +		igt_info("  ***  RACE DETECTED: Unexpected errno = %d (%s)\n",
> +			 unexpected_errno, strerror(unexpected_errno));
> +		igt_info("  This indicates the kernel may not be properly handling concurrent\n");
> +		igt_info("  CHANGE_HANDLE operations. Kernel should serialize these with\n");
> +		igt_info("  proper locking to prevent corruption and concurrent access issues.\n");
> +	}
> +	igt_assert_f(race_detected == 0,
> +		     "Race condition detected! errno=%d (%s). "
> +		     "Kernel locking may be insufficient.\n",
> +		     unexpected_errno, strerror(unexpected_errno));
> +}
> +
> +/*
> + * =======================================================================
> + * RACE CONDITION #3: CHANGE_HANDLE vs Prime Ioctls
> + * =======================================================================
> + *
> + *
> + * "maybe: 1. create bo 2. handle2fd, check that fd2handle gives us
> + *  the same handle back 3. change_handle 4. check that fd2handle
> + *  gives us the new handle back"
> + *
> + * Tests stale references, reference count corruption.
> + */
> +
> +/**
> + * change_handle_prime_thread - Continuously swap handle for prime test
> + *
> + * Like change_handle_thread_a/b but swaps back and forth between
> + * the two handle values to continuously exercise the race.
> + */
> +static void *change_handle_prime_thread(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	uint32_t handle_a = data->handle;
> +	uint32_t handle_b = data->alt_handle;
> +	bool swap_direction = true;
> +	int ret;
> +	pthread_t tid = pthread_self();
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		if (swap_direction) {
> +			/* Try to change from handle_a to handle_b */
> +			ret = gem_change_handle(data->ctx, handle_a, handle_b);
> +			if (verbose_logging) {
> +				if (ret == 0) {
> +					igt_info("[PRIME-CHANGE-TID:%lu] %u -> %u: SUCCESS\n",
> +						 (unsigned long)tid, handle_a, handle_b);
> +				} else {
> +					igt_info("[PRIME-CHANGE-TID:%lu] %u -> %u: FAILED - %s (errno=%d)\n",
> +						 (unsigned long)tid, handle_a, handle_b,
> +					 strerror(errno), errno);
> +				}
> +			}
> +		} else {
> +			/* Try to change from handle_b to handle_a */
> +			ret = gem_change_handle(data->ctx, handle_b, handle_a);
> +			if (verbose_logging) {
> +				if (ret == 0) {
> +					igt_info("[PRIME-CHANGE-TID:%lu] %u -> %u: SUCCESS\n",
> +						 (unsigned long)tid, handle_b, handle_a);
> +				} else {
> +					igt_info("[PRIME-CHANGE-TID:%lu] %u -> %u: FAILED - %s (errno=%d)\n",
> +						 (unsigned long)tid, handle_b, handle_a,
> +					 strerror(errno), errno);
> +				}
> +			}
> +		}
> +
> +		/* Flip direction for next iteration to keep swapping */
> +		if (ret == 0)
> +			swap_direction = !swap_direction;

swap(handle_a, handle_b) and you can drop swap_direction and consolidate 
to a single gem_change_handle. Plus, probably it is the same thread body 
as for the change_handle_thread_a/b.

> +		/* All errors are acceptable during race - kernel will serialize */
> +
> +		sched_yield();
> +	}
> +
> +	return NULL;
> +}
> +
> +static void *prime_thread(void *arg)
> +{
> +	struct thread_data *data = arg;
> +	struct drm_prime_handle prime_args;
> +	uint32_t retrieved_handle;
> +	uint32_t handle_a = data->handle;
> +	uint32_t handle_b = data->alt_handle;
> +	int dmabuf_fd;
> +	int ret;
> +	pthread_t tid = pthread_self();
> +	uint32_t tried_handle;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/*
> +		 * Try handle_a first. If it fails (handle was changed),
> +		 * try handle_b. One of them should work.
> +		 */
> +		prime_args.handle = handle_a;
> +		prime_args.flags = DRM_CLOEXEC | DRM_RDWR;
> +		tried_handle = handle_a;
> +		ret = igt_ioctl(data->ctx->fd, DRM_IOCTL_PRIME_HANDLE_TO_FD, &prime_args);
> +		if (verbose_logging) {
> +			if (ret == 0) {
> +				igt_info("[PRIME-TID:%lu] HANDLE_TO_FD(handle=%u): SUCCESS (fd=%d)\n",
> +					 (unsigned long)tid, tried_handle, prime_args.fd);
> +			} else {
> +				igt_info("[PRIME-TID:%lu] HANDLE_TO_FD(handle=%u): FAILED - %s (errno=%d)\n",
> +					 (unsigned long)tid, tried_handle,
> +					 strerror(errno), errno);
> +			}

It may be worth adding new helpers such as verbose_info and hide "if 
(verbose_logging)" in them, and tid=pthread_self(), and fold the "if 
(ret == 0) into one log. All in all end with something along the line of:

   ret = igt_ioctl(data->ctx->fd, DRM_IOCTL_PRIME_HANDLE_TO_FD, 
&prime_args);
   verbose_info("...", pthread_self(), ret, ...other args for the wanted 
format...)

I am suggesting these things because the less repeated boiler plate 
there is the easier is to review the test logic.

I'll skip this sub test for now in case we agree a more radable version 
would be coming.

> +		}
> +		if (ret != 0) {
> +			/* handle_a failed, try handle_b */
> +			prime_args.handle = handle_b;
> +			tried_handle = handle_b;
> +			ret = igt_ioctl(data->ctx->fd, DRM_IOCTL_PRIME_HANDLE_TO_FD, &prime_args);
> +			if (verbose_logging) {
> +				if (ret == 0) {
> +					igt_info("[PRIME-TID:%lu] HANDLE_TO_FD(handle=%u): SUCCESS (fd=%d)\n",
> +						 (unsigned long)tid, tried_handle, prime_args.fd);
> +				} else {
> +					igt_info("[PRIME-TID:%lu] HANDLE_TO_FD(handle=%u): FAILED - %s (errno=%d)\n",
> +						 (unsigned long)tid, tried_handle,
> +					 strerror(errno), errno);
> +				}
> +			}
> +		}
> +
> +		if (ret == 0) {
> +			dmabuf_fd = prime_args.fd;
> +
> +			/* Convert back to handle */
> +			prime_args.fd = dmabuf_fd;
> +			prime_args.flags = 0;
> +			ret = igt_ioctl(data->ctx->fd, DRM_IOCTL_PRIME_FD_TO_HANDLE, &prime_args);
> +			if (verbose_logging) {
> +				if (ret == 0) {
> +					igt_info("[PRIME-TID:%lu] FD_TO_HANDLE(fd=%d): SUCCESS (handle=%u)\n",
> +						 (unsigned long)tid, dmabuf_fd, prime_args.handle);
> +				} else {
> +					igt_info("[PRIME-TID:%lu] FD_TO_HANDLE(fd=%d): FAILED - %s (errno=%d)\n",
> +						 (unsigned long)tid, dmabuf_fd,
> +					 strerror(errno), errno);
> +				}
> +			}
> +			if (ret == 0) {
> +				retrieved_handle = prime_args.handle;
> +
> +				/*
> +				 * Handle should be one of our two known handles.
> +				 * If it's neither, Prime reference table is corrupted.
> +				 */
> +				if (retrieved_handle != handle_a &&
> +				    retrieved_handle != handle_b) {
> +					/* Handle corruption detected */
> +					__sync_fetch_and_add(data->race_detected, 1);
> +				}
> +
> +				/* Close retrieved handle */
> +				gem_close_bo(data->ctx, retrieved_handle);
> +			}
> +			close(dmabuf_fd);
> +		}
> +		/* All errors acceptable during race */
> +
> +		usleep(100); /* Prime operations are slower */
> +	}
> +
> +	return NULL;
> +}
> +
> +/**
> + * test_race_change_vs_prime - Race CHANGE_HANDLE against Prime ioctls
> + *
> + *
> + * Implements email thread test:
> + * "create bo, handle2fd, check fd2handle returns same, change_handle,
> + *  check fd2handle returns new handle"
> + *
> + * Thread A: Continuously changes handle
> + * Thread B: Continuously does fd2handle and validates result
> + *
> + * Validates kernel updates Prime references correctly.
> + */
> +static void test_race_change_vs_prime(struct gpu_ctx *ctx)
> +{
> +	pthread_t thread_change, thread_prime;
> +	pthread_barrier_t barrier;
> +	struct thread_data data = {0};
> +	uint32_t race_detected = 0;
> +	int unexpected_errno = 0;
> +	uint32_t handle;
> +	struct drm_prime_handle prime_args;
> +	int dmabuf_fd, ret;
> +	uint32_t retrieved_handle;
> +
> +	igt_info("Testing RACE #3: CHANGE_HANDLE vs Prime on %s\n",
> +		 gpu_name(ctx->driver));
> +	igt_info("  Duration: %d seconds\n", RACE_DURATION_SEC);
> +	igt_info("  Goal: Detect stale references and refcount corruption\n");
> +
> +	handle = gem_create_bo(ctx, BO_SIZE);
> +	igt_assert(handle != 0);
> +
> +	/* Initial prime export - verify it works */
> +	prime_args.handle = handle;
> +	prime_args.flags = DRM_CLOEXEC | DRM_RDWR;
> +	ret = igt_ioctl(ctx->fd, DRM_IOCTL_PRIME_HANDLE_TO_FD, &prime_args);
> +	igt_assert_eq(ret, 0);
> +	dmabuf_fd = prime_args.fd;
> +
> +	prime_args.fd = dmabuf_fd;
> +	prime_args.flags = 0;
> +	ret = igt_ioctl(ctx->fd, DRM_IOCTL_PRIME_FD_TO_HANDLE, &prime_args);
> +	igt_assert_eq(ret, 0);
> +	retrieved_handle = prime_args.handle;
> +	igt_assert_eq(retrieved_handle, handle);
> +
> +	gem_close_bo(ctx, retrieved_handle);
> +	close(dmabuf_fd);
> +
> +	/* Now test concurrent change + prime operations */
> +	data.ctx = ctx;
> +	data.handle = handle;
> +	data.alt_handle = handle + 1;
> +	data.race_detected = &race_detected;
> +	data.unexpected_errno = &unexpected_errno;
> +	__atomic_store_n(&data.running, true, __ATOMIC_RELEASE);
> +
> +	pthread_barrier_init(&barrier, NULL, 2);
> +	data.barrier = &barrier;
> +
> +	igt_assert_eq(pthread_create(&thread_change, NULL, change_handle_prime_thread, &data), 0);
> +	igt_assert_eq(pthread_create(&thread_prime, NULL, prime_thread, &data), 0);
> +
> +	/* Let them race */
> +	sleep(RACE_DURATION_SEC);
> +
> +	__atomic_store_n(&data.running, false, __ATOMIC_RELEASE);
> +	pthread_join(thread_change, NULL);
> +	pthread_join(thread_prime, NULL);
> +
> +	pthread_barrier_destroy(&barrier);
> +
> +	/* Cleanup */
> +	gem_close_bo(ctx, handle);
> +	gem_close_bo(ctx, handle + 1);
> +
> +	igt_info("  Race test completed. Handle corruption: %u\n", race_detected);
> +	igt_assert_eq(race_detected, 0);
> +}
> +
> +/*
> + * Aggressive race test - follows proven concurrent access reproducer pattern.
> + * Thread A: CHANGE_HANDLE(h->nh), Thread B: CLOSE(h)
> + * CPU pinning for maximum race potential.
> + */
> +
> +static void *aggressive_change_thread(void *arg)
> +{
> +	struct aggressive_data *data = arg;
> +	pthread_t tid = pthread_self();
> +	int ret;
> +
> +	pin_to_cpu(0);
> +
> +	while (!__atomic_load_n(&data->go, __ATOMIC_ACQUIRE))
> +		gem_change_handle_wait();
> +
> +	ret = gem_change_handle(data->ctx, data->handle, data->new_handle);
> +
> +	if (verbose_logging) {
> +		if (ret == 0) {
> +			igt_info("[AGG-CHANGE-TID:%lu] %u -> %u: SUCCESS\n",
> +				 (unsigned long)tid, data->handle, data->new_handle);
> +		} else {
> +			igt_info("[AGG-CHANGE-TID:%lu] %u -> %u: FAILED - %s (errno=%d)\n",
> +				 (unsigned long)tid, data->handle, data->new_handle,
> +				 strerror(errno), errno);
> +		}
> +	}
> +
> +	return NULL;
> +}
> +
> +static void *aggressive_close_thread(void *arg)
> +{
> +	struct aggressive_data *data = arg;
> +	pthread_t tid = pthread_self();
> +
> +	pin_to_cpu(1);
> +
> +	while (!__atomic_load_n(&data->go, __ATOMIC_ACQUIRE))
> +		gem_change_handle_wait();
> +
> +	gem_close_bo(data->ctx, data->handle);
> +
> +	if (verbose_logging) {
> +		igt_info("[AGG-CLOSE-TID:%lu] Closed handle %u\n",
> +			 (unsigned long)tid, data->handle);

Closed or failed to close right?

> +	}
> +
> +	return NULL;
> +}
> +
> +static void test_race_aggressive(struct gpu_ctx *ctx)
> +{
> +	struct aggressive_data data = {};
> +	pthread_t thread_change, thread_close;
> +	int iterations = 5000;
> +	int race_wins = 0;
> +	int kasan_before, kasan_after;
> +	int i;
> +
> +	igt_info("Testing AGGRESSIVE RACE: CHANGE_HANDLE vs CLOSE on %s\n",
> +		 gpu_name(ctx->driver));
> +	igt_info("  Pattern: concurrent access reproducer from DRM mailing list\n");
> +	igt_info("  Iterations: %d\n", iterations);
> +	igt_info("  CPU pinning: Change->CPU0, Close->CPU1\n");
> +	igt_info("\n");
> +	igt_info("  Expected results:\n");
> +	igt_info("    Unpatched kernel: Race wins ~50-60%%, KASAN traces in dmesg\n");
> +	igt_info("    Patched kernel:   0 race wins (mutex serializes ops)\n");
> +	igt_info("\n");
> +	igt_info("  Note: KASAN traces appear in kernel log (dmesg), not test output\n");
> +	igt_info("        Kernel must have CONFIG_KASAN=y to see detailed concurrent access reports\n");
> +	igt_info("\n");

This is very worthwhile info but I'd put it in a comment, not log.

Is it worth running this test when KASAN is not enabled?

What makes this more "aggressive" than test_race_change_vs_close? CPU 
pinning? The first one does not catch it so reliably?

> +
> +	data.ctx = ctx;
> +
> +	/* Clear/mark kernel log before test */
> +	kasan_before = check_kernel_traces();
> +
> +	for (i = 0; i < iterations; i++) {
> +		uint32_t h = gem_create_bo(ctx, BO_SIZE);
> +
> +		data.handle = h;
> +		data.new_handle = 0x4000 + (i & 0x3FFF);
> +		__atomic_store_n(&data.go, 0, __ATOMIC_RELEASE);
> +
> +		__sync_synchronize();

What are the memory barriers for?

> +
> +		pthread_create(&thread_change, NULL, aggressive_change_thread, &data);
> +		pthread_create(&thread_close, NULL, aggressive_close_thread, &data);
> +
> +		__sync_synchronize();
> +		__atomic_store_n(&data.go, 1, __ATOMIC_RELEASE);
> +
> +		pthread_join(thread_change, NULL);

On dual CPU this could be penalizing the thread which happens to share 
the CPU with the main thread, becuase the other one is likely to start 
first. Have you tried? If I am right it could be worth adding 
igt_require(num_cpus > 2) and pinning the main thread to a different one.

> +		pthread_join(thread_close, NULL);
> +
> +		/*
> +		 * concurrent access Detection Strategy:
> +		 *
> +		 * The concurrent access happens when CHANGE_HANDLE races with CLOSE.
> +		 * Handle state checking doesn't work because:
> +		 * - With mutex: CHANGE can win cleanly (not a race)
> +		 * - Without mutex: concurrent access happens but handles appear normal
> +		 *
> +		 * ONLY reliable detection: Monitor kernel log for concurrent access traces.
> +		 * concurrent access shows up in drm_gem_object_release_handle path.
> +		 */
> +
> +		/* Clean up handles (one or both may fail) */
> +		drmIoctl(ctx->fd, DRM_IOCTL_GEM_CLOSE,
> +			 &(struct drm_gem_close){ .handle = data.new_handle });
> +		drmIoctl(ctx->fd, DRM_IOCTL_GEM_CLOSE,
> +			 &(struct drm_gem_close){ .handle = h });
> +
> +		if ((i + 1) % 1000 == 0) {
> +			/* Check for KASAN traces periodically */
> +			int kasan_now = check_kernel_traces();
> +			int kasan_new = kasan_now - kasan_before;
> +
> +			igt_info("  Progress: %d/%d, KASAN traces: %d\n",
> +				 i + 1, iterations, kasan_new);
> +
> +			if (kasan_new > 0 && race_wins == 0)
> +				race_wins = kasan_new;
> +		}
> +	}
> +
> +	/* Final KASAN check */
> +	kasan_after = check_kernel_traces();
> +	race_wins = kasan_after - kasan_before;
> +
> +	igt_info("\nAggressive race test completed:\n");
> +	igt_info("  Iterations: %d\n", iterations);
> +	igt_info("  KASAN concurrent access traces detected: %d\n", race_wins);
> +
> +	if (race_wins > 0) {
> +		igt_info("\n*** RACE CONDITION DETECTED (concurrent access) ***\n");
> +		igt_info("  Kernel is UNPATCHED (missing handle_map_lock mutex)\n");
> +		igt_info("  KASAN detected %d concurrent access issues events\n", race_wins);
> +		igt_info("\n");
> +		igt_info("  View concurrent access traces:\n");
> +		igt_info("    dmesg | grep -A40 -E '(drm_gem_object_release_handle|drm_gem_object_handle_put_unlocked)'\n");
> +		igt_info("\n");
> +		igt_info("  The concurrent access happens when CHANGE_HANDLE tries to access\n");
> +		igt_info("  an object that was freed by concurrent CLOSE.\n");
> +		igt_info("\n");
> +		igt_info("  Fix: Apply V5 patch (add handle_map_lock mutex)\n");
> +
> +		/* Fail the test if concurrent access detected */
> +		igt_assert_eq(race_wins, 0);
> +	} else {
> +		igt_info("\n=== NO concurrent access DETECTED ===\n");
> +		igt_info("  Kernel appears PATCHED (handle_map_lock prevents race)\n");
> +		igt_info("  No KASAN traces found after %d iterations\n", iterations);
> +		igt_info("  This is the expected behavior with V5 patch applied\n");
> +		igt_info("\n");
> +		igt_info("  Note: concurrent access detection via kernel log monitoring\n");
> +		igt_info("        Works with KASAN or kernel oops/warnings\n");
> +	}
> +}
> +
> +/*
> + * =======================================================================
> + * SINGLE-THREADED TEST - Focused race exploitation
> + * =======================================================================
> + */
> +
> +/*
> + * =======================================================================
> + * SINGLE-THREADED TEST - Fixed timing
> + * =======================================================================
> + */

The single threaded wording really confuses me because the test actually 
creates three threads. :)

> +
> +static void *single_thread_hammer(void *arg)
> +{
> +	struct single_thread_data *data = arg;
> +	uint32_t handle, alt_handle;
> +	int local_fd;
> +	int ret;
> +	bool is_base = true;
> +	unsigned long swaps = 0;
> +	struct gpu_ctx local_ctx;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	/* Create BO BEFORE closer starts */
> +	pthread_mutex_lock(data->fd_lock);
> +	local_fd = *data->main_fd;
> +	pthread_mutex_unlock(data->fd_lock);
> +
> +	local_ctx = *data->ctx;
> +	local_ctx.fd = local_fd;

Isn't this the same as if the locked section simply copied data->ctx 
into local_ctx?

> +
> +	handle = gem_create_bo(&local_ctx, 4096);
> +	if (handle == 0) {
> +		igt_info("[HAMMER] Failed to create BO\n");
> +		/* Signal even on failure */
> +		__atomic_store_n(&data->hammer_ready, true, __ATOMIC_RELEASE);
> +		return NULL;
> +	}
> +
> +	alt_handle = handle + 1;
> +	igt_info("[HAMMER] Created handle %u, will swap with %u\n", handle, alt_handle);
> +
> +	/* Signal that BO is ready - closer can start now */
> +	__atomic_store_n(&data->hammer_ready, true, __ATOMIC_RELEASE);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/* Rapid swap - no FD checks, just swap */
> +		ret = gem_change_handle(&local_ctx,
> +					is_base ? handle : alt_handle,
> +					is_base ? alt_handle : handle);
> +		if (ret == 0) {
> +			swaps++;
> +			__sync_fetch_and_add(&data->swap_count, 1);
> +			is_base = !is_base;
> +
> +			if (swaps % 10000 == 0)
> +				igt_info("[HAMMER] %lu swaps\n", swaps);
> +		}
> +		/* No error handling - just keep hammering */

Won't closer immediately close the fd hammer is using to swap - or is 
that the very point? But in that case why it is worth to keep trying 
after the first failure?

> +	}
> +
> +	igt_info("[HAMMER] Final: %lu swaps\n", swaps);
> +	return NULL;
> +}
> +
> +static void *single_thread_closer(void *arg)
> +{
> +	struct single_thread_data *data = arg;
> +	unsigned long closes = 0;
> +	int new_fd;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	/* Wait for hammer to create BO first */
> +	while (!__atomic_load_n(&data->hammer_ready, __ATOMIC_ACQUIRE))
> +		usleep(100);

Not yield this time, okay.

> +
> +	igt_info("[CLOSER] Hammer ready, starting closes\n");
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/* Close FD to trigger idr_for_each() */
> +		pthread_mutex_lock(data->fd_lock);
> +		if (*data->main_fd >= 0) {
> +			close(*data->main_fd);
> +			*data->main_fd = -1;
> +			closes++;
> +			__sync_fetch_and_add(&data->close_count, 1);
> +		}
> +		pthread_mutex_unlock(data->fd_lock);
> +
> +		/* Small delay - this is the window for hitting the race */
> +		usleep(1000);
> +
> +		/* Reopen */
> +		new_fd = drm_open_driver_render(DRIVER_ANY);
> +		if (new_fd >= 0) {
> +			pthread_mutex_lock(data->fd_lock);
> +			*data->main_fd = new_fd;
> +			pthread_mutex_unlock(data->fd_lock);
> +		}
> +
> +		/* Check KASAN */
> +		if (closes % 100 == 0) {
> +			int kasan_now = check_kernel_traces();
> +
> +			if (kasan_now > 0) {
> +				__sync_fetch_and_add(data->race_hits, 1);
> +				igt_info("[CLOSER] *** KASAN DETECTED: %d traces ***\n", kasan_now);
> +			}
> +		}
> +	}
> +
> +	igt_info("[CLOSER] %lu closes\n", closes);
> +	return NULL;
> +}
> +
> +static void *single_thread_monitor(void *arg)
> +{
> +	struct single_thread_data *data = arg;
> +	int kasan_last = 0;
> +	int kasan_now;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		sleep(5);

The three threads appear to be run for 3 seconds from the controlling 
thread so this sleeping for five means it only checks once?

Also, the closer  thread itself periodically checks dmesg so is this one 
needed to begin with?

> +
> +		kasan_now = check_kernel_traces();
> +		if (kasan_now > kasan_last) {
> +			igt_info("[MONITOR] +%d KASAN traces (total: %d)\n",
> +				 kasan_now - kasan_last, kasan_now);
> +			kasan_last = kasan_now;
> +		}
> +
> +		igt_info("[STATS] Swaps:%u Closes:%u KASAN:%u\n",
> +			 __atomic_load_n(&data->swap_count, __ATOMIC_RELAXED),
> +			__atomic_load_n(&data->close_count, __ATOMIC_RELAXED),
> +			*data->race_hits);
> +	}
> +
> +	return NULL;
> +}
> +
> +static void test_race_single_thread(struct gpu_ctx *ctx)
> +{
> +	pthread_t hammer, closer, monitor;
> +	pthread_barrier_t barrier;
> +	pthread_mutex_t fd_lock = PTHREAD_MUTEX_INITIALIZER;
> +	struct single_thread_data data = {0};
> +	uint32_t race_hits = 0;
> +	int main_fd;
> +	int kasan_before, kasan_after;
> +	int race_detected;
> +
> +	igt_info("===========================================================\n");
> +	igt_info("  SINGLE-THREADED FOCUSED TEST (Fixed Timing)\n");
> +	igt_info("===========================================================\n");
> +	igt_info("  Duration: 3 seconds\n");
> +	igt_info("  Threads: 1 hammer + 1 closer + 1 monitor\n");
> +	igt_info("  Strategy:\n");
> +	igt_info("    1. Hammer creates ONE BO\n");
> +	igt_info("    2. Hammer swaps H <-> H+1 rapidly in tight loop\n");
> +	igt_info("    3. Closer periodically close(fd) -> idr_for_each()\n");
> +	igt_info("  Race window: idr_alloc(new) ... idr_replace(old, NULL)\n");
> +	igt_info("    Between these two, BOTH handles point to same object\n");
> +	igt_info("    If idr_for_each() runs here -> double release -> concurrent access\n");
> +	igt_info("===========================================================\n\n");
> +
> +	kasan_before = check_kernel_traces();
> +	igt_info("KASAN traces before test: %d\n\n", kasan_before);
> +
> +	main_fd = drm_open_driver_render(DRIVER_ANY);
> +	igt_require(main_fd >= 0);
> +
> +	data.ctx = ctx;
> +	data.main_fd = &main_fd;
> +	data.fd_lock = &fd_lock;
> +	__atomic_store_n(&data.running, true, __ATOMIC_RELEASE);
> +	__atomic_store_n(&data.hammer_ready, false, __ATOMIC_RELEASE);
> +	data.race_hits = &race_hits;
> +
> +	pthread_barrier_init(&barrier, NULL, 3);
> +	data.barrier = &barrier;
> +
> +	igt_info("Starting threads...\n");
> +
> +	pthread_create(&hammer, NULL, single_thread_hammer, &data);
> +	pthread_create(&closer, NULL, single_thread_closer, &data);
> +	pthread_create(&monitor, NULL, single_thread_monitor, &data);
> +
> +	igt_info("Racing for 3 seconds...\n\n");
> +	sleep(3);
> +
> +	igt_info("\nStopping threads...\n");
> +	__atomic_store_n(&data.running, false, __ATOMIC_RELEASE);
> +
> +	pthread_join(hammer, NULL);
> +	pthread_join(closer, NULL);
> +	pthread_join(monitor, NULL);
> +
> +	pthread_barrier_destroy(&barrier);
> +	pthread_mutex_destroy(&fd_lock);
> +
> +	if (main_fd >= 0)
> +		close(main_fd);
> +
> +	kasan_after = check_kernel_traces();
> +	race_detected = kasan_after - kasan_before;
> +
> +	igt_info("\n===========================================================\n");
> +	igt_info("  SINGLE-THREADED TEST RESULTS\n");
> +	igt_info("===========================================================\n");
> +	igt_info("  Total swaps: %u\n", __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED));
> +	igt_info("  Total closes: %u\n", __atomic_load_n(&data.close_count, __ATOMIC_RELAXED));
> +	igt_info("  KASAN concurrent access traces: %d\n", race_detected);
> +	igt_info("===========================================================\n\n");
> +
> +	if (race_detected > 0) {
> +		igt_info("*** SUCCESS: RACE CONDITION TRIGGERED! ***\n\n");
> +		igt_info("concurrent access detected with %d KASAN traces!\n\n", race_detected);
> +		igt_info("This confirms the vulnerability in the wrong operation order:\n\n");
> +		igt_info("  Race Timeline:\n");
> +		igt_info("  --------------\n");
> +		igt_info("  T1: Hammer thread calls change_handle(H, H+1)\n");
> +		igt_info("      -> enters drm_gem_change_handle_ioctl()\n");
> +		igt_info("      -> spin_lock(&table_lock)\n");
> +		igt_info("      -> idr_alloc(H+1, obj)\n");
> +		igt_info("         [RACE WINDOW OPENS - Both H and H+1 point to obj]\n\n");
> +		igt_info("  T2: Closer thread calls close(fd)\n");
> +		igt_info("      -> drm_gem_release()\n");
> +		igt_info("      -> idr_for_each(&object_idr, release_handle, ...)\n");
> +		igt_info("         Iteration 1: handle H -> release(obj)\n");
> +		igt_info("         Iteration 2: handle H+1 -> release(obj) AGAIN\n");
> +		igt_info("      -> DOUBLE RELEASE -> USE-AFTER-FREE!\n\n");
> +		igt_info("  T3: Hammer thread continues (if not crashed):\n");
> +		igt_info("      -> idr_replace(H, NULL)\n");
> +		igt_info("         [Too late - obj already freed]\n\n");
> +		igt_info("View KASAN traces:\n");
> +		igt_info("  sudo dmesg | grep -B10 -A40 'concurrent access issues'\n\n");
> +		igt_info("The fix (correct order):\n");
> +		igt_info("  1. idr_replace(H, NULL)  FIRST  <- Make H invisible\n");
> +		igt_info("  2. idr_alloc(H+1, obj)   SECOND <- Create new handle\n");
> +		igt_info("  Result: At no point do both handles exist simultaneously\n");
> +		igt_info("          idr_for_each() can never see both -> no double release\n\n");
> +	} else {
> +		igt_info("=== NO concurrent access DETECTED ===\n\n");
> +		if (data.swap_count == 0) {
> +			igt_info("ERROR: No successful handle swaps!\n");
> +			igt_info("The change_handle ioctl may not be working properly.\n\n");
> +		} else if (__atomic_load_n(&data.swap_count, __ATOMIC_RELAXED) < 100) {
> +			igt_info("WARNING: Very few swaps (%u). May not have hit race window.\n\n",
> +				 __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED));
> +		} else {
> +			igt_info("Completed %u swaps and %u closes without detecting concurrent access.\n\n",
> +				 __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED),
> +				 __atomic_load_n(&data.close_count, __ATOMIC_RELAXED));
> +			igt_info("Possible reasons:\n");
> +			igt_info("  1. Correct patch is applied (NULL old BEFORE alloc new)\n");
> +			igt_info("  2. Race window is extremely small (nanoseconds)\n");
> +			igt_info("  3. Timing didn't align to hit the exact window\n");
> +			igt_info("  4. KASAN may not be sensitive enough to catch it\n");
> +			igt_info("  5. Test needs different timing parameters\n\n");
> +			igt_info("Note: Absence of concurrent access detection doesn't prove correctness.\n");
> +			igt_info("      Code analysis shows the race exists in principle.\n");
> +		}
> +	}
> +}
> +
> +/*
> + * =======================================================================
> + * RANDOM HANDLE TEST - Try random handle numbers to find free slots
> + * =======================================================================
> + */
> +
> +static void *random_handle_hammer(void *arg)
> +{
> +	struct random_handle_data *data = arg;
> +	uint32_t handle;
> +	int local_fd;
> +	int ret;
> +	unsigned long swaps = 0;
> +	unsigned long attempts = 0;
> +	struct gpu_ctx local_ctx;
> +	uint32_t random_handle;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	/* Create BO BEFORE closer starts */
> +	pthread_mutex_lock(data->fd_lock);
> +	local_fd = *data->main_fd;
> +	pthread_mutex_unlock(data->fd_lock);
> +
> +	local_ctx = *data->ctx;
> +	local_ctx.fd = local_fd;
> +
> +	handle = gem_create_bo(&local_ctx, 4096);
> +	if (handle == 0) {
> +		igt_info("[HAMMER] Failed to create BO\n");
> +		__atomic_store_n(&data->hammer_ready, true, __ATOMIC_RELEASE);
> +		return NULL;
> +	}
> +
> +	igt_info("[HAMMER] Created base handle %u\n", handle);
> +	__atomic_store_n(&data->hammer_ready, true, __ATOMIC_RELEASE);
> +
> +	/* Seed random number generator with thread ID + time */
> +	srand(time(NULL) ^ pthread_self());
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/* Try random handle numbers in different ranges */
> +		int range = attempts % 4;
> +
> +		switch (range) {
> +		case 0:
> +			/* Small random offset (1-100) */
> +			random_handle = handle + (rand() % 100) + 1;
> +			break;
> +		case 1:
> +			/* Medium random offset (100-10000) */
> +			random_handle = handle + (rand() % 9900) + 100;
> +			break;
> +		case 2:
> +			/* Large random offset (1M-2M) */
> +			random_handle = handle + 1000000 + (rand() % 1000000);
> +			break;
> +		case 3:
> +			/* Completely random handle */
> +			random_handle = rand() % 0xFFFFFF;
> +			if (random_handle == handle)
> +				random_handle++;
> +			break;
> +		}
> +
> +		attempts++;
> +		__sync_fetch_and_add(&data->attempt_count, 1);
> +
> +		/* Try to change to random handle */
> +		ret = gem_change_handle(&local_ctx, handle, random_handle);
> +		if (ret == 0) {
> +			swaps++;
> +			__sync_fetch_and_add(&data->swap_count, 1);
> +
> +			/* Successfully swapped, now swap back */
> +			ret = gem_change_handle(&local_ctx, random_handle, handle);
> +			if (ret != 0) {
> +				/* Failed to swap back, update current handle */
> +				handle = random_handle;
> +			}
> +
> +			if (swaps % 100 == 0)
> +				igt_info("[HAMMER] %lu successful swaps (%.2f%% success rate)\n",
> +					 swaps, 100.0 * swaps / attempts);
> +		}
> +
> +		/* Every 10000 attempts, report stats */
> +		if (attempts % 10000 == 0) {
> +			igt_info("[HAMMER] %lu attempts, %lu swaps (%.4f%% success)\n",
> +				 attempts, swaps, 100.0 * swaps / attempts);
> +		}
> +	}
> +
> +	igt_info("[HAMMER] Final: %lu swaps from %lu attempts (%.4f%%)\n",
> +		 swaps, attempts, 100.0 * swaps / attempts);
> +
> +	/* Cleanup current handle */
> +	gem_close_bo(&local_ctx, handle);
> +
> +	return NULL;
> +}
> +
> +static void *random_handle_closer(void *arg)

Same as the single thread closer?

> +{
> +	struct random_handle_data *data = arg;
> +	unsigned long closes = 0;
> +	int new_fd;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	/* Wait for hammer to create BO first */
> +	while (!__atomic_load_n(&data->hammer_ready, __ATOMIC_ACQUIRE))
> +		usleep(100);
> +
> +	igt_info("[CLOSER] Hammer ready, starting closes\n");
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		/* Close FD to trigger idr_for_each() */
> +		pthread_mutex_lock(data->fd_lock);
> +		if (*data->main_fd >= 0) {
> +			close(*data->main_fd);
> +			*data->main_fd = -1;
> +			closes++;
> +			__sync_fetch_and_add(&data->close_count, 1);
> +		}
> +		pthread_mutex_unlock(data->fd_lock);
> +
> +		/* Small delay - race window */
> +		usleep(1000);
> +
> +		/* Reopen */
> +		new_fd = drm_open_driver_render(DRIVER_ANY);
> +		if (new_fd >= 0) {
> +			pthread_mutex_lock(data->fd_lock);
> +			*data->main_fd = new_fd;
> +			pthread_mutex_unlock(data->fd_lock);
> +		}
> +
> +		/* Check KASAN */
> +		if (closes % 100 == 0) {
> +			int kasan_now = check_kernel_traces();
> +
> +			if (kasan_now > 0) {
> +				__sync_fetch_and_add(data->race_hits, 1);
> +				igt_info("[CLOSER] *** KASAN DETECTED: %d traces ***\n", kasan_now);
> +			}
> +		}
> +	}
> +
> +	igt_info("[CLOSER] %lu closes\n", closes);
> +	return NULL;
> +}
> +
> +static void *random_handle_monitor(void *arg)

Same as the single threaded monitor?

> +{
> +	struct random_handle_data *data = arg;
> +	int kasan_last = 0;
> +	int kasan_now;
> +
> +	pthread_barrier_wait(data->barrier);
> +
> +	while (__atomic_load_n(&data->running, __ATOMIC_ACQUIRE)) {
> +		sleep(5);
> +
> +		kasan_now = check_kernel_traces();
> +		if (kasan_now > kasan_last) {
> +			igt_info("[MONITOR] +%d KASAN traces (total: %d)\n",
> +				 kasan_now - kasan_last, kasan_now);
> +			kasan_last = kasan_now;
> +		}
> +
> +		igt_info("[STATS] Attempts:%u Swaps:%u Closes:%u KASAN:%u (%.4f%% success)\n",
> +			 __atomic_load_n(&data->attempt_count, __ATOMIC_RELAXED),
> +			 __atomic_load_n(&data->swap_count, __ATOMIC_RELAXED),
> +			 __atomic_load_n(&data->close_count, __ATOMIC_RELAXED),
> +			 *data->race_hits,
> +			 (__atomic_load_n(&data->attempt_count, __ATOMIC_RELAXED) > 0) ?
> +			 (100.0 * __atomic_load_n(&data->swap_count,
> +			 __ATOMIC_RELAXED) / __atomic_load_n(&data->attempt_count,
> +			 __ATOMIC_RELAXED)) : 0);
> +	}
> +
> +	return NULL;
> +}
> +
> +static void test_race_random_handles(struct gpu_ctx *ctx)
> +{
> +	pthread_t hammer, closer, monitor;
> +	pthread_barrier_t barrier;
> +	pthread_mutex_t fd_lock = PTHREAD_MUTEX_INITIALIZER;
> +	struct random_handle_data data = {0};
> +	uint32_t race_hits = 0;
> +	int main_fd;
> +	int kasan_before, kasan_after;
> +	int race_detected;
> +
> +	igt_info("===========================================================\n");
> +	igt_info("  RANDOM HANDLE TEST\n");
> +	igt_info("===========================================================\n");
> +	igt_info("  Duration: 3 seconds\n");
> +	igt_info("  Threads: 1 hammer + 1 closer + 1 monitor\n");
> +	igt_info("  Strategy:\n");
> +	igt_info("    1. Hammer creates ONE BO\n");
> +	igt_info("    2. Hammer tries RANDOM new handle numbers\n");
> +	igt_info("    3. Ranges: small (1-100), medium (100-10K),\n");
> +	igt_info("       large (1M-2M), completely random\n");
> +	igt_info("    4. Swaps back to original handle on success\n");
> +	igt_info("    5. Closer periodically close(fd) -> idr_for_each()\n");
> +	igt_info("  Goal: Find free handle slots by random probing\n");
> +	igt_info("===========================================================\n\n");
> +
> +	kasan_before = check_kernel_traces();
> +	igt_info("KASAN traces before test: %d\n\n", kasan_before);
> +
> +	main_fd = drm_open_driver_render(DRIVER_ANY);
> +	igt_require(main_fd >= 0);
> +
> +	data.ctx = ctx;
> +	data.main_fd = &main_fd;
> +	data.fd_lock = &fd_lock;
> +	__atomic_store_n(&data.running, true, __ATOMIC_RELEASE);
> +	__atomic_store_n(&data.hammer_ready, false, __ATOMIC_RELEASE);
> +	data.race_hits = &race_hits;
> +
> +	pthread_barrier_init(&barrier, NULL, 3);
> +	data.barrier = &barrier;
> +
> +	igt_info("Starting threads...\n");
> +
> +	pthread_create(&hammer, NULL, random_handle_hammer, &data);
> +	pthread_create(&closer, NULL, random_handle_closer, &data);
> +	pthread_create(&monitor, NULL, random_handle_monitor, &data);
> +
> +	igt_info("Racing for 3 seconds...\n\n");
> +	sleep(3);
> +
> +	igt_info("\nStopping threads...\n");
> +	__atomic_store_n(&data.running, false, __ATOMIC_RELEASE);
> +
> +	pthread_join(hammer, NULL);
> +	pthread_join(closer, NULL);
> +	pthread_join(monitor, NULL);
> +
> +	pthread_barrier_destroy(&barrier);
> +	pthread_mutex_destroy(&fd_lock);
> +
> +	if (main_fd >= 0)
> +		close(main_fd);
> +
> +	kasan_after = check_kernel_traces();
> +	race_detected = kasan_after - kasan_before;
> +
> +	igt_info("\n===========================================================\n");
> +	igt_info("  RANDOM HANDLE TEST RESULTS\n");
> +	igt_info("===========================================================\n");
> +	igt_info("  Total attempts: %u\n", __atomic_load_n(&data.attempt_count, __ATOMIC_RELAXED));
> +	igt_info("  Successful swaps: %u\n", __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED));
> +	if (__atomic_load_n(&data.attempt_count, __ATOMIC_RELAXED) > 0) {
> +		igt_info("  Success rate: %.4f%%\n",
> +			 100.0 * __atomic_load_n(&data.swap_count,
> +			 __ATOMIC_RELAXED) / __atomic_load_n(&data.attempt_count,
> +			 __ATOMIC_RELAXED));
> +	}
> +	igt_info("  Total closes: %u\n", __atomic_load_n(&data.close_count, __ATOMIC_RELAXED));
> +	igt_info("  KASAN concurrent access traces: %d\n", race_detected);
> +	igt_info("===========================================================\n\n");
> +
> +	if (race_detected > 0) {
> +		igt_info("*** SUCCESS: RACE CONDITION TRIGGERED! ***\n\n");
> +		igt_info("concurrent access detected with %d KASAN traces!\n\n", race_detected);
> +		igt_info("This confirms the race with random handle probing.\n\n");
> +		igt_info("View KASAN traces:\n");
> +		igt_info("  sudo dmesg | grep -B10 -A40 'concurrent access issues'\n\n");
> +	} else {
> +		igt_info("=== NO concurrent access DETECTED ===\n\n");
> +		if (data.swap_count == 0) {
> +			igt_info("ERROR: No successful handle swaps!\n");
> +			igt_info("Random probing also failed to find free handles.\n\n");
> +		} else if (__atomic_load_n(&data.swap_count, __ATOMIC_RELAXED) < 100) {
> +			igt_info("WARNING: Very few swaps (%u). May not have hit race window.\n\n",
> +				 __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED));
> +		} else {
> +			igt_info("Completed %u swaps and %u closes without detecting concurrent access.\n\n",
> +				 __atomic_load_n(&data.swap_count, __ATOMIC_RELAXED),
> +				 __atomic_load_n(&data.close_count, __ATOMIC_RELAXED));
> +			igt_info("Random handle probing success rate: %.4f%%\n\n",
> +				 100.0 * __atomic_load_n(&data.swap_count,
> +				 __ATOMIC_RELAXED) / __atomic_load_n(&data.attempt_count,
> +				 __ATOMIC_RELAXED));
> +			if (__atomic_load_n(&data.swap_count, __ATOMIC_RELAXED) > 1000)
> +				igt_info("Good swap rate - race window likely too small to hit.\n");
> +		}
> +	}
> +}
> +
> +/*
> + * Close-before-lock test - Exact race from vulnerability report
> + *
> + * Tests concurrent GEM_CLOSE and CHANGE_HANDLE operations.
> + * The race exploits the window where GEM_CLOSE runs BEFORE change_handle
> + * takes table_lock for idr_alloc:
> + *
> + *   Thread A (change_handle)          Thread B (GEM_CLOSE on H)
> + *   -----------------------          -------------------------
> + *   obj = lookup(H)  refcount 1->2
> + *                                    handle_count 1->0 -> put(obj)
> + *                                      refcount 2->1
> + *                                    idr_remove(H)
> + *   idr_alloc(obj, N)
> + *   idr_replace(NULL, H): H empty,
> + *     returns NULL -- discarded!
> + *   idr_replace(obj, N)
> + *   out: put(obj)  refcount 1->0
> + *     -> obj FREED
> + *
> + * End state: object_idr[N] points at freed obj -> concurrent access
> + *
> + * Uses DRM_IOCTL_MODE_CREATE_DUMB (driver-agnostic, no libdrm needed).
> + * Semaphore sync + CPU pinning for maximum race window exploitation.
> + *
> + * Expected:
> + *   Unpatched kernel: "Race Success" + KASAN traces in dmesg
> + *   Patched kernel (Sima's fix): 0 race wins in 2000 iterations
> + */
> +
> +static void *race_change_worker(void *arg)
> +{
> +	struct race_shared *s = arg;
> +
> +	pin_to_cpu(1);
> +	sem_wait(&s->change_sem);
> +
> +	if (igt_ioctl(s->fd, DRM_IOCTL_GEM_CHANGE_HANDLE, &s->ch) == 0)
> +		s->change_success = 1;
> +
> +	return NULL;
> +}
> +
> +static void *race_close_worker(void *arg)
> +{
> +	struct race_shared *s = arg;
> +
> +	pin_to_cpu(0);
> +	sem_wait(&s->close_sem);
> +
> +	if (igt_ioctl(s->fd, DRM_IOCTL_GEM_CLOSE, &s->cl) == 0)
> +		s->close_success = 1;
> +
> +	return NULL;
> +}
> +
> +static void test_race_close_before_lock(struct gpu_ctx *ctx)
> +{
> +	struct race_shared shared;
> +	int iterations = 2000;
> +	int race_wins = 0;
> +	int kasan_before, kasan_after;
> +	int i;
> +
> +	igt_info("Testing Close-before-lock test on %s\n",
> +		 gpu_name(ctx->driver));
> +	igt_info("  Tests close-before-lock scenario)\n");
> +	igt_info("  Race: GEM_CLOSE wins before CHANGE_HANDLE takes table_lock\n");
> +	igt_info("  Method: Semaphore sync + CPU pinning\n");
> +	igt_info("  Iterations: %d\n", iterations);
> +	igt_info("  Detection: Both change AND close succeed simultaneously\n\n");
> +
> +	shared.fd = ctx->fd;
> +	kasan_before = check_kernel_traces();
> +
> +	for (i = 0; i < iterations; i++) {
> +		struct drm_mode_create_dumb create = {
> +			.width = 64,
> +			.height = 64,
> +			.bpp = 32,
> +		};
> +		pthread_t tid_change, tid_close;
> +		int ret;
> +
> +		ret = igt_ioctl(ctx->fd, DRM_IOCTL_MODE_CREATE_DUMB, &create);
> +		if (ret < 0) {
> +			/*
> +			 * MODE_CREATE_DUMB may not be supported on all
> +			 * drivers/configs. Fall back to gem_create_bo.
> +			 */
> +			create.handle = gem_create_bo(ctx, BO_SIZE);
> +		}
> +
> +		shared.old_handle = create.handle;
> +		shared.new_handle = 0x4000 + i;
> +		shared.ch.handle = shared.old_handle;
> +		shared.ch.new_handle = shared.new_handle;
> +		shared.cl.handle = shared.old_handle;
> +		shared.change_success = 0;
> +		shared.close_success = 0;
> +
> +		sem_init(&shared.change_sem, 0, 0);
> +		sem_init(&shared.close_sem, 0, 0);
> +
> +		igt_assert_eq(pthread_create(&tid_change, NULL,
> +					     race_change_worker, &shared), 0);
> +		igt_assert_eq(pthread_create(&tid_close, NULL,
> +					     race_close_worker, &shared), 0);
> +
> +		/* Brief delay to let threads reach sem_wait */
> +		usleep(100);
> +
> +		/* Fire both threads as close to simultaneously as possible */
> +		sem_post(&shared.change_sem);
> +		sem_post(&shared.close_sem);

pthread_barrier approach the other test cases use does not work here?

> +
> +		pthread_join(tid_change, NULL);
> +		pthread_join(tid_close, NULL);
> +
> +		sem_destroy(&shared.change_sem);
> +		sem_destroy(&shared.close_sem);
> +
> +		if (shared.change_success && shared.close_success) {
> +			race_wins++;
> +			igt_info("  [%d] *** RACE WIN: both change and close "
> +				 "succeeded (handle %u -> %u) ***\n",
> +				 i, shared.old_handle, shared.new_handle);
> +			/*
> +			 * new_handle now points to a freed object.
> +			 * Do NOT touch it -- just record the event.
> +			 * The dangling handle will be cleaned up on fd close.
> +			 */
> +		} else if (shared.change_success) {
> +			/* Change won, close lost -- normal, clean up new handle */
> +			struct drm_gem_close cleanup = {
> +				.handle = shared.new_handle
> +			};
> +			igt_ioctl(ctx->fd, DRM_IOCTL_GEM_CLOSE, &cleanup);
> +		}
> +		/* If close won and change lost: handle already freed, nothing to do */
> +
> +		if ((i + 1) % 500 == 0)
> +			igt_info("  Progress: %d/%d (race wins: %d)\n",
> +				 i + 1, iterations, race_wins);
> +	}
> +
> +	kasan_after = check_kernel_traces();
> +
> +	igt_info("\n  Results:\n");
> +	igt_info("  Iterations: %d\n", iterations);
> +	igt_info("  Race wins (both succeeded): %d\n", race_wins);
> +	igt_info("  KASAN concurrent access traces: %d\n", kasan_after - kasan_before);
> +
> +	if (race_wins > 0) {
> +		igt_info("\n  *** concurrent access RACE DETECTED ***\n");
> +		igt_info("  %d iterations had both CHANGE_HANDLE and GEM_CLOSE\n"
> +			 "  succeed on the same handle. The new handle now\n"
> +			 "  points to a freed GEM object.\n\n", race_wins);
> +		igt_info("  View KASAN traces:\n");
> +		igt_info("    sudo dmesg | grep -B5 -A40 'concurrent access issues'\n\n");
> +	} else {
> +		igt_info("\n  === NO RACE DETECTED ===\n");
> +		igt_info("  Kernel appears patched. No iteration had both\n");
> +		igt_info("  CHANGE_HANDLE and GEM_CLOSE succeed simultaneously.\n");
> +	}
> +
> +	/*
> +	 * Fail the test if races were detected -- this is a security bug.
> +	 * If KASAN found concurrent access traces, that's definitive proof.
> +	 */
> +	igt_assert_f(race_wins == 0,
> +		     "concurrent access race detected: %d wins in %d iterations\n",
> +		     race_wins, iterations);
> +}
> +
> +int igt_main()
> +{
> +	struct gpu_ctx ctx = { .fd = -1 };
> +
> +	igt_fixture() {
> +		ctx.fd = drm_open_driver_render(DRIVER_ANY);
> +		igt_require(ctx.fd >= 0);

Please double check but I have a feeling drm_open_driver_render() comes 
with a built-in skip on failure.

> +
> +	require_dmesg_access();
> +
> +		ctx.driver = detect_driver(ctx.fd);
> +		igt_require_f(ctx.driver != DRIVER_TYPE_UNKNOWN,
> +			      "Unsupported GPU driver\n");
> +
> +		igt_info("===============================================\n");
> +		igt_info("  GPU-Agnostic Race Condition Tests\n");
> +		igt_info("  Running on: %s\n", gpu_name(ctx.driver));
> +		igt_info("===============================================\n");
> +
> +#if HAS_AMDGPU
> +		if (ctx.driver == DRIVER_TYPE_AMDGPU) {
> +			uint32_t major, minor;
> +			int err = amdgpu_device_initialize(ctx.fd, &major, &minor,
> +							   &ctx.amdgpu_device);

Is libdrm needed?

> +			igt_require(err == 0);
> +			igt_info("  AMDGPU version: %d.%d\n", major, minor);
> +		}
> +#endif
> +
> +		if (ctx.driver == DRIVER_TYPE_I915) {
> +			igt_require_gem(ctx.fd);
> +			igt_info("  i915 GEM verified\n");
> +		}
> +
> +		igt_info("===============================================\n\n");
> +	}
> +
> +	igt_describe("Race Condition #1: CHANGE_HANDLE vs GEM_CLOSE (concurrent access issues)");
> +	igt_subtest("race-change-vs-close")
> +		test_race_change_vs_close(&ctx);
> +
> +	igt_describe("Race Condition #2: Concurrent CHANGE_HANDLE (handle corruption)");
> +	igt_subtest("race-change-vs-change")
> +		test_race_change_vs_change(&ctx);
> +
> +	igt_describe("Race Condition #3: CHANGE_HANDLE vs Prime (stale references)");
> +	igt_subtest("race-change-vs-prime")
> +		test_race_change_vs_prime(&ctx);
> +	igt_describe("Aggressive concurrent access race: CHANGE_HANDLE vs CLOSE with KASAN detection");
> +	igt_subtest("race-aggressive-change-vs-close")
> +		test_race_aggressive(&ctx);
> +	igt_describe("Single-thread: One BO swapped H<->H+1 with periodic FD close");
> +	igt_subtest("race-exploit-single-thread")
> +		test_race_single_thread(&ctx);
> +	igt_describe("Random handle probing: Try random new_handle values to find free slots");
> +	igt_subtest("race-exploit-random-handles")
> +		test_race_random_handles(&ctx);
> +	igt_describe(" GEM_CLOSE races CHANGE_HANDLE lookup ");
> +	igt_subtest("race-close-before-lock")
> +		test_race_close_before_lock(&ctx);
> +
> +	igt_fixture() {
> +#if HAS_AMDGPU
> +		if (ctx.driver == DRIVER_TYPE_AMDGPU && ctx.amdgpu_device)
> +			amdgpu_device_deinitialize(ctx.amdgpu_device);
> +#endif
> +		drm_close_driver(ctx.fd);
> +	}
> +}
> diff --git a/tests/meson.build b/tests/meson.build
> index 1ac89bab7..c8375af8a 100644
> --- a/tests/meson.build
> +++ b/tests/meson.build
> @@ -106,6 +106,7 @@ intel_i915_progs = [
>   	'gem_caching',
>   	'gem_create',
>   	'gem_ccs',
> +	'gem_change_handle_race',
>   	'gem_close',
>   	'gem_close_race',
>   	'gem_compute',

Regards,

Tvrtko