Re: [PATCH v3 1/3] drm/xe: Capture devcoredump on TLB invalidation timeout

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Uncancelled deferred devcoredump work on the global workqueue leads to UAF if the driver is unbound/unloaded before the work executes.
--

--- Patch [1]: [PATCH v3 1/3] drm/xe: Capture devcoredump on TLB invalidation timeout ---
commit e17a9749756454a4d7c32af8d34a73ac7b919a3e
Author: Tales A. Mendonça <[email protected]>

drm/xe: Capture devcoredump on TLB invalidation timeout

This commit adds xe_devcoredump_gt() to capture GuC log and CT state
for hangs that are not tied to an exec queue or job. It also hooks
this mechanism up to the TLB invalidation timeout path.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8678

> diff --git a/drivers/gpu/drm/xe/xe_devcoredump.c b/drivers/gpu/drm/xe/xe_devcoredump.c
> --- a/drivers/gpu/drm/xe/xe_devcoredump.c
> +++ b/drivers/gpu/drm/xe/xe_devcoredump.c
[ ... ]
> @@ -323,40 +318,44 @@ static void devcoredump_snapshot(struct xe_devcoredump *coredump,
[ ... ]
> +	if (q) {
> +		ss->ge = xe_guc_exec_queue_snapshot_capture(q);
> +		if (job)
> +			ss->job = xe_sched_job_snapshot_capture(job);
> +		ss->vm = xe_vm_snapshot_capture(q->vm);
> +
> +		xe_engine_snapshot_capture_for_queue(q);
> +	}
>  
>  	queue_work(system_dfl_wq, &ss->work);

[Severity: High]
This is a pre-existing issue, but does this deferred work item on the global
system_dfl_wq cause a use-after-free if the driver is unbound before it
executes?

During teardown, xe_driver_devcoredump_fini() calls dev_coredump_put(). If
the work hasn't run yet, the coredump device hasn't been registered by the
deferred worker.

Consequently, dev_coredump_put() finds no device, returns silently, and
never invokes xe_devcoredump_free(). The work remains uncanceled on
system_dfl_wq and will eventually execute using a freed xe_device.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1