Re: [PATCH 2/2] drm/i915/perf: Remove sysfs group on OA config idr_alloc() failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Concurrent execution of i915_perf_add_config_ioctl and i915_perf_unregister can lead to a Use-After-Free of perf->metrics_kobj.
--

commit e80590029db9506ad40df9f792adcff0ddb3c4d7
Author: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>

drm/i915/perf: Remove sysfs group on OA config idr_alloc() failure

This commit fixes a resource leak where an OA config's sysfs group was not
removed if idr_alloc() failed. It adds a new remove_sysfs error path to
clean up the sysfs group.

> diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c
> index 96823dcd3fae2..abda7b1c49569 100644
> --- a/drivers/gpu/drm/i915/i915_perf.c
> +++ b/drivers/gpu/drm/i915/i915_perf.c
[ ... ]
> @@ -4738,6 +4738,8 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data,
>  
>  	return id;
>  
> +remove_sysfs:
> +	sysfs_remove_group(perf->metrics_kobj, &oa_config->sysfs_metric);

[Severity: Critical]
This is a pre-existing issue, but can this sequence lead to a Use-After-Free
of perf->metrics_kobj during a concurrent hardware hot-unplug?

If a user-space process repeatedly calls the DRM_IOCTL_I915_PERF_ADD_CONFIG
ioctl while the driver is being unbound:

CPU1 (Hot-unplug/Unbind)
i915_perf_unregister()
    kobject_put(perf->metrics_kobj);
    perf->metrics_kobj = NULL;

CPU2 (ioctl)
i915_perf_add_config_ioctl()
    // passes early NULL check for perf->metrics_kobj before CPU1 clears it

Then CPU2 could eventually reach this newly added error path (or the existing
create_dynamic_oa_sysfs_entry() call) and pass the freed perf->metrics_kobj
pointer to sysfs_remove_group(), causing a Use-After-Free.

Since i915_driver_unregister() calls i915_perf_unregister() before calling
drm_dev_unplug(), the DRM core hasn't yet blocked incoming ioctls.

Does this lockless teardown of the kobject require synchronization or holding
a reference during the ioctl?

>  sysfs_err:
>  	mutex_unlock(&perf->metrics_lock);
>  reg_err:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260908231511.1217426-4-umesh.nerlige.ramappa@intel.com?part=2