Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Missing explicit cancellation of asynchronous interrupt work items (ih_soft_work, ih1_work, ih2_work) during device teardown, leading to a Use-After-Free. -- --- Patch [1]: [PATCH] drm/amdgpu: Change system_unbound_wq with system_dfl_wq --- commit 65cddcba7474a0c152afd7f127fd2e2ad98c63ac Author: Marco Crivellari <[email protected]> drm/amdgpu: Change system_unbound_wq with system_dfl_wq This commit replaces the deprecated system_unbound_wq with the newer system_dfl_wq to avoid deprecation warnings. The patch aims to keep the existing workqueue behavior intact. > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c > b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c > @@ -547,7 +547,7 @@ void amdgpu_irq_delegate(struct amdgpu_device *adev, > unsigned int num_dw) > { > amdgpu_ih_ring_write(adev, &adev->irq.ih_soft, entry->iv_entry, num_dw); > - queue_work(system_unbound_wq, &adev->irq.ih_soft_work); > + queue_work(system_dfl_wq, &adev->irq.ih_soft_work); [Severity: High] This is a pre-existing issue, but since we are modifying the workqueue submission here, does the teardown path leave ih_soft_work pending? If a hardware interrupt fires just before device unbind or module unload, adev->irq.ih_soft_work can be queued onto the global system workqueue. When the driver proceeds with teardown, it frees the interrupt handler and the ring buffers: drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c:amdgpu_irq_fini_hw() { if (adev->irq.installed) { free_irq(adev->irq.irq, adev_to_drm(adev)); ... amdgpu_ih_ring_fini(adev, &adev->irq.ih_soft); } However, it doesn't appear to explicitly call cancel_work_sync() for the pending work items before freeing the adev structure. Could this result in a use-after-free if the global workqueue asynchronously executes the amdgpu_irq_handle_ih_soft() work item after the device memory is freed? > } -- Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1
