Re: [PATCH v10 3/9] drm/xe/hw_error: Guard csc_hw_error_work() with runtime PM

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:
- [High] xe: missing cancel_work_sync() for csc_hw_error_work causes UAF
- [Medium] drm/xe: missing multiple invocation protection in xe_survivability_mode_runtime_enable() causes sysfs WARN
- [Low] drm/xe: missing xe_pm.h header inclusion for guard(xe_pm_runtime)
--

commit 8e1fc55f44fb943c373142f62d0ab081c339411d
Author: Raag Jadav <raag.jadav@intel.com>
    
drm/xe/hw_error: Guard csc_hw_error_work() with runtime PM
    
This commit adds a runtime PM reference around the survivability mode
enablement path in the hardware error worker.

> diff --git a/drivers/gpu/drm/xe/xe_hw_error.c b/drivers/gpu/drm/xe/xe_hw_error.c
> index f53a6b3055de1..7575cc09cc2a9 100644
> --- a/drivers/gpu/drm/xe/xe_hw_error.c
> +++ b/drivers/gpu/drm/xe/xe_hw_error.c
> @@ -170,6 +170,7 @@ static void csc_hw_error_work(struct work_struct *work)
>  	struct xe_tile *tile = container_of(work, typeof(*tile), csc_hw_error_work);
>  	struct xe_device *xe = tile_to_xe(tile);
>  
> +	guard(xe_pm_runtime)(xe);

[Severity: Low]
Does this compile cleanly?

The guard(xe_pm_runtime) macro requires the corresponding cleanup class
definition class_xe_pm_runtime_t.

This class is defined in xe_pm.h, but it appears xe_hw_error.c doesn't
include it directly or indirectly, which might lead to an unknown type
build error.

[Severity: High]
Is there a missing work cancellation regression during device teardown?

csc_hw_error_work is queued to the system workqueue upon a hardware error.
If the driver is removed or the module unloaded, the DRM and device core
release paths will free the xe and tile structures.

If cancel_work_sync() is missing during teardown, couldn't an executing
or pending worker cause a use-after-free when it tries to dereference xe
in this guard?

>  	xe_survivability_mode_runtime_enable(xe);

[Severity: Medium]
Could multiple hardware errors trigger a sysfs warning regression here?

csc_hw_error_work() can be queued and executed multiple times. If
xe_survivability_mode_runtime_enable() is invoked unconditionally on each
run, it will attempt to re-register the existing sysfs files via
create_survivability_sysfs().

This could fail with -EEXIST and trigger a kernel warning about duplicate
filenames.

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016072623.457392-1-raag.jadav@intel.com?part=3