Re: [PATCH v3 2/7] drm/xe/hw_error: Initialize hw_error_work per tile

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/xe/hw_error: missing xe_hw_error_work_disable() on probe error unwind
--

commit 07d05aa9e22e61afa48de05e4142a663fa2508dd
Author: Riana Tauro <riana.tauro@intel.com>

drm/xe/hw_error: Initialize hw_error_work per tile

This commit initializes tile->hw_error_work across all tiles in
xe_hw_error_init() and adds xe_hw_error_work_disable() in
xe_device_remove() to stop the hardware error work items on device
removal.

> diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
> index 07a7ab6ac0832..8f498e3e3e586 100644
> --- a/drivers/gpu/drm/xe/xe_device.c
> +++ b/drivers/gpu/drm/xe/xe_device.c
[ ... ]
> @@ -1118,6 +1119,8 @@ int xe_device_probe(struct xe_device *xe)
>  
>  void xe_device_remove(struct xe_device *xe)
>  {
> +	xe_hw_error_work_disable(xe);
> +
>  	xe_display_unregister(xe);
>  
>  	drm_dev_unplug(&xe->drm);

[Severity: High]
As reported by Sashiko on v2 [1], what happens if xe_device_probe() fails
after xe_hw_error_init() has already run?

During probe, xe_device_probe() calls xe_irq_install(), which invokes
xe_hw_error_init(xe) before allocating or requesting IRQs:

drivers/gpu/drm/xe/xe_irq.c:xe_irq_install() {
	xe_hw_error_init(xe);

	xe_irq_reset(xe);
	...
	err = pci_alloc_irq_vectors(pdev, nvec, nvec, irq_flags);
	if (err < 0) {
		drm_err(&xe->drm, "Failed to allocate IRQ vectors: %d\n", err);
		return err;
	}
}

Inside xe_hw_error_init(), process_hw_errors() -> xe_hw_error_irq_handler()
can immediately schedule tile->hw_error_work, and once xe_irq_install()
enables interrupts, dg1_irq_handler() can also schedule tile->hw_error_work
while the rest of xe_device_probe() is executing.

However, in __xe_pci_probe(), xe_pci_remove() -> xe_device_remove() is
only called if xe_pm_init() fails after xe_device_probe() has already
succeeded:

drivers/gpu/drm/xe/xe_pci.c:__xe_pci_probe() {
	err = xe_device_probe(xe);
	if (err)
		return err;

	err = xe_pm_init(xe);
	if (err)
		goto err_driver_cleanup;

	return 0;

err_driver_cleanup:
	xe_pci_remove(pdev);
	return err;
}

If xe_irq_install() fails after xe_hw_error_init(), or if any subsequent
step in xe_device_probe() fails (such as xe_gt_init(), xe_vram_memtest(),
or xe_heci_gsc_init()), xe_device_remove() is never called. Can
tile->hw_error_work remain pending or running while devres_release_all()
unmaps MMIO and frees struct xe_device, causing a use-after-free on probe
error unwind?

[1] https://lore.kernel.org/r/20261026060459.771448-13-riana.tauro@intel.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103060929.1586783-9-riana.tauro@intel.com?part=2