Re: [PATCH v4 2/3] drm/xe/guc: Protect timeout handling from device unplug

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe: UAF in scheduler timer due to NO_HANG return during unplug
--

commit 89f2548ce53ddab43344452d08720715459b50fd
Author: Satyanarayana K V P <satyanarayana.k.v.p@intel.com>

drm/xe/guc: Protect timeout handling from device unplug

This commit guards the GuC scheduler timeout callback with drm_dev_enter()
and drm_dev_exit() to handle device unplug. If the device is unplugged,
it marks the job with -ENODEV and returns DRM_GPU_SCHED_STAT_NO_HANG.

> diff --git a/drivers/gpu/drm/xe/xe_guc_submit.c b/drivers/gpu/drm/xe/xe_guc_submit.c
> index 0b231228bde8b..443842e87498e 100644
> --- a/drivers/gpu/drm/xe/xe_guc_submit.c
> +++ b/drivers/gpu/drm/xe/xe_guc_submit.c
> @@ -1599,6 +1599,12 @@ guc_exec_queue_timedout_job(struct drm_sched_job *drm_job)
>  	int err = -ETIME;
>  	pid_t pid = -1;
>  	bool wedged = false, wedge_device = false, skip_timeout_check;
> +	int idx;
> +
> +	if (!drm_dev_enter(&xe->drm, &idx)) {
> +		xe_sched_job_set_error(job, -ENODEV);
> +		return DRM_GPU_SCHED_STAT_NO_HANG;

[Severity: High]
Does returning DRM_GPU_SCHED_STAT_NO_HANG here during device unplug cause a
use-after-free in the scheduler timer?

When the unplug path calls drm_sched_fini(), it stops queues and waits on
cancel_delayed_work_sync(&sched->work_tdr). Concurrently, returning
DRM_GPU_SCHED_STAT_NO_HANG from the timeout handler instructs the scheduler
to reinsert the job onto pending_list and call
drm_sched_start_timeout_unlocked().

Because pending_list is not empty, drm_sched_start_timeout_unlocked()
re-arms work_tdr via mod_delayed_work().

Once the timeout handler returns, cancel_delayed_work_sync() completes, but
the timer remains actively armed. After drm_sched_fini() finishes and devm
frees the scheduler, the armed timer fires, causing a panic.

Should this return DRM_GPU_SCHED_STAT_ENODEV instead to prevent re-arming
the timer?

> +	}
>  
>  	xe_gt_assert(guc_to_gt(guc), !exec_queue_destroyed(q));

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009145906.886719-5-satyanarayana.k.v.p@intel.com?part=2