Re: [PATCH v3 3/3] drm/xe/gt: Disable GT reset worker before engine teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe/gt: UAF in reset worker racing with GuC/GSC devres teardown
--

commit b50233919776c7d521074ae26d515654e814d647
Author: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>
Subject: drm/xe/gt: Disable GT reset worker before engine teardown

This commit registers a GT-level devres action to disable and drain the 
reset worker right after xe_hw_engines_init(). This aims to ensure the 
worker is halted before any engine is torn down.

> --- a/drivers/gpu/drm/xe/xe_gt.c
> +++ b/drivers/gpu/drm/xe/xe_gt.c
[ ... ]
> @@ -656,6 +668,11 @@ static int gt_init_with_all_forcewake(struct xe_gt *gt)
>  	if (err)
>  		return err;
>  
> +	/* Disable worker before releasing HW engines */
> +	err = devm_add_action_or_reset(gt_to_xe(gt)->drm.dev, gt_reset_worker_disable, gt);

[Severity: High]
Does this cause a use-after-free or NULL pointer dereference during teardown?

Because devres actions are executed in LIFO order, registering
gt_reset_worker_disable here means it will execute AFTER any devres actions
registered by subsequent initialization steps, such as
xe_uc_init_post_hwconfig().

Specifically, during GSC teardown, free_resources() destroys the workqueue:

drivers/gpu/drm/xe/xe_gsc.c:free_resources() {
    ...
    if (gsc->wq) {
        destroy_workqueue(gsc->wq);
        gsc->wq = NULL;
    }
}

Because this teardown happens before the reset worker is disabled, a
concurrently running reset worker can reach this point:

drivers/gpu/drm/xe/xe_gsc.c:xe_gsc_load_start() {
    ...
    queue_work(gsc->wq, &gsc->work);
}

If the reset worker calls queue_work() while gsc->wq is freed or NULL, it
will cause a crash.

> +	if (err)
> +		return err;
> +
>  	err = xe_uc_init_post_hwconfig(&gt->uc);
>  	if (err)
>  		return err;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009121921.818671-5-satyanarayana.k.v.p@intel.com?part=3