Re: [RFC v2 03/21] drm/xe: Implement xe_access_counter_init

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Use-After-Free of pagefault_wq during driver teardown
--

commit 20e692318868f2addad6bfad38a665a6947c5cfe
Author: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>

drm/xe: Implement xe_access_counter_init

This commit implements initialization for access counter queues and
per-queue workers. It reuses the existing page fault workqueue for
the shared USM domain.

> diff --git a/drivers/gpu/drm/xe/xe_access_counter.c b/drivers/gpu/drm/xe/xe_access_counter.c
> index f3a8a93b5135d..ae939576b72da 100644
> --- a/drivers/gpu/drm/xe/xe_access_counter.c
> +++ b/drivers/gpu/drm/xe/xe_access_counter.c
[ ... ]
> @@ -35,7 +52,29 @@
>  int xe_access_counter_init(struct xe_device *xe)
>  {
[ ... ]
> +	/*
> +	 * drmm-managed so it outlives destroy_workqueue(pagefault_wq), which
> +	 * drains the shared AC workers during xe_pagefault_fini.
> +	 */

[Severity: Critical]
This is a pre-existing issue, but does reusing the page fault workqueue
here expose the driver to a use-after-free during teardown?

The pagefault_wq is destroyed in xe_pagefault_fini() (in
drivers/gpu/drm/xe/xe_pagefault.c) via a devm action, which runs early
during driver unbind or probe failure. 

However, the GuC CT g2h_worker that receives page faults and routes
them to this workqueue is stopped via a drmm action in guc_ct_fini(),
which runs much later when the last reference to the DRM device is dropped.

This creates a lifecycle mismatch window. If the hardware generates a fault
from a still-executing workload during unbind, the driver unbinds and
destroys pagefault_wq, but the g2h_worker remains active. When the
G2H message arrives, xe_pagefault_handler() calls queue_work() on the
freed workqueue.

Could this occur deterministically during driver unbind?

> +	ac_queue->data = drmm_kzalloc(&xe->drm, ac_queue->size, GFP_KERNEL);
> +	if (!ac_queue->data)
> +		return -ENOMEM;
> +
> +	spin_lock_init(&ac_queue->lock);
> +	xe_access_counter_queue_init(xe, ac_queue);
> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909124457.1610890-23-himal.prasad.ghimiray@intel.com?part=3