Re: [PATCH v3 1/5] drm/xe/gt: Use GT ordered workqueue for wedging

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Lockless TOCTOU race on work_struct initialization can lead to queueing an uninitialized work item.
--

commit 70fa657e4e9d6562a705a7808a6bc4a42f57256e
Author: Raag Jadav <raag.jadav@intel.com>
Subject: drm/xe/gt: Use GT ordered workqueue for wedging

This commit introduces a GT ordered workqueue for GT wedge handling to
avoid disrupting the scheduler with in-flight jobs. It adds a wedge worker
initialized during GT init and queued when a wedge is declared.

> diff --git a/drivers/gpu/drm/xe/xe_gt.c b/drivers/gpu/drm/xe/xe_gt.c
> index 478e047031f4f..200e34331c195 100644
> --- a/drivers/gpu/drm/xe/xe_gt.c
> +++ b/drivers/gpu/drm/xe/xe_gt.c

[ ... ]

> @@ -1195,6 +1207,7 @@ void xe_gt_declare_wedged(struct xe_gt *gt)
>  {
>  	xe_gt_assert(gt, gt_to_xe(gt)->wedged.mode);
>  
> -	xe_uc_declare_wedged(&gt->uc);
> -	xe_tlb_inval_reset(&gt->tlb_inval);
> +	/* Prevent queueing uninitialized worker if hit during probe */
> +	if (gt->wedge.worker.func)
> +		queue_work(gt->ordered_wq, &gt->wedge.worker);

[Severity: High]
Could this lockless check of the work_struct func field lead to list
corruption on weakly ordered architectures?

During driver probe, an asynchronous hardware fault (such as a PCI AER or
an I2C interrupt) could trigger xe_gt_declare_wedged() concurrently with
xe_gt_init().

In xe_gt_init(), the worker is initialized via:

INIT_WORK(&gt->wedge.worker, gt_wedge_worker);

This macro sets the work_struct's data, entry, and finally func, but does so
without memory barriers. If an interrupting CPU observes the writes out of
order due to CPU store reordering, func could be seen as non-NULL while data
or entry remain uninitialized.

If that happens, xe_gt_declare_wedged() would pass this check and call
queue_work() with a partially initialized work_struct. This can cause a
kernel panic in the workqueue core. Is there a safer way to synchronize
this probe-time wedge check without relying on lockless field inspection?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907083541.2194747-1-raag.jadav@intel.com?part=1