Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Resurrecting TTM BOs with the unified GEM refcount exposes partially-destroyed zombie objects to xe_drm_client debugfs, leading to a NULL pointer dereference. --
commit a805e1b4ddde0006d8b373c7aed2f75ce95ec7db Author: Natalie Vock <[email protected]> drm/ttm: replace TTMs refcount with the DRM refcount v4 This commit replaces the separate TTM object reference count with the DRM GEM object reference count. This allows the use of drm_exec inside TTM and avoids maintaining two reference counts for one object. > diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c > index 3980f376e3ba4..2b470c1746f60 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo.c > +++ b/drivers/gpu/drm/ttm/ttm_bo.c [ ... ] > @@ -246,88 +246,84 @@ static void ttm_bo_delayed_delete(struct work_struct > *work) [ ... ] > - kref_init(&bo->kref); > - spin_unlock(&bdev->lru_lock); > + kref_init(&bo->base.refcount); > + bo->base.funcs = &ttm_deleted_object_funcs; > + spin_unlock(&bo->bdev->lru_lock); [Severity: High] By resurrecting the GEM refcount here to 1, could this expose partially-destroyed zombie objects to subsystems like the xe_drm_client? For example, the client list might still hold the BO, and xe_drm_client.c:show_meminfo() attempts to grab a reference: if (!kref_get_unless_zero(&bo->ttm.base.refcount)) continue; Since the GEM refcount is now resurrected instead of a separate TTM refcount, this check will succeed on a zombie BO. If show_meminfo() then acquires the BO's resv lock after the ttm_bo_delayed_delete() worker has called ttm_bo_cleanup_memtype_use() (which sets bo->resource to NULL), it will dereference the NULL resource in bo_meminfo(): u32 mem_type = bo->ttm.resource->mem_type; Can this lead to a NULL pointer dereference kernel panic when reading the debugfs file? -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2
