Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] `ttm_resource_manager_set_dmem_region()` fails to clear the cgroup region pointer when passed `NULL`, leaving a dangling pointer that can cause a use-after-free. --
commit 02822c8c1770f6a971fca6d0ddb57472d4eea596 Author: Thomas Hellström <[email protected]> drm/ttm: Hook up a cgroup-aware reclaim callback for the dmem controller This commit introduces functionality to evict buffer objects charged to a specific dmem cgroup pool from a resource manager's LRU. It adds ttm_resource_manager_set_dmem_region() to associate a dmem cgroup region with a resource manager, and provides a reclaim callback that drivers can wire up to TTM eviction. > diff --git a/drivers/gpu/drm/ttm/ttm_resource.c > b/drivers/gpu/drm/ttm/ttm_resource.c > index 154d6739256f8..ad00723e99ef1 100644 > --- a/drivers/gpu/drm/ttm/ttm_resource.c > +++ b/drivers/gpu/drm/ttm/ttm_resource.c [ ... ] > +void ttm_resource_manager_set_dmem_region(struct ttm_resource_manager *man, > + struct dmem_cgroup_region *region) > +{ > + if (!IS_ERR_OR_NULL(region)) > + man->cg = region; > +} > +EXPORT_SYMBOL(ttm_resource_manager_set_dmem_region); [Severity: High] The v5 changelog mentions handling a NULL region here to clear the reclaim callback and prevent use-after-free bugs. However, if region is NULL, !IS_ERR_OR_NULL(region) evaluates to false. Does this skip the assignment and fail to clear man->cg, leaving a dangling pointer if a driver tries to detach the region before teardown? Should this code check !IS_ERR(region) instead, or unconditionally assign man->cg = NULL when the passed region is NULL? -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
