[PATCH] accel/qaic: Protect perf stats BO state with bo->lock

[PATCH] accel/qaic: Protect perf stats BO state with bo->lock

[Shuvam Pandey]

qaic_perf_stats_bo_ioctl() validates each BO by checking bo->sliced and
bo->dbc before returning its perf stats. These fields are changed by the
detach paths while holding bo->lock, but the perf stats ioctl reads them
without that lock.

A concurrent detach can clear bo->dbc and mark the BO unsliced while the
perf stats ioctl is validating the BO. Take bo->lock while checking the
BO state and copying the per-BO stats into the temporary result buffer.

Fixes: 4ddf4ddfceb4 ("accel/qaic: Ensure entry belongs to DBC in qaic_perf_stats_bo_ioctl()")
Signed-off-by: Shuvam Pandey <shuvampandey1@gmail.com>
---
 drivers/accel/qaic/qaic_data.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c
index 1e4c579d2..1d74c2ec3 100644
--- a/drivers/accel/qaic/qaic_data.c
+++ b/drivers/accel/qaic/qaic_data.c
@@ -1834,15 +1834,16 @@ int qaic_perf_stats_bo_ioctl(struct drm_device *dev, void *data, struct drm_file
 			goto free_ent;
 		}
 		bo = to_qaic_bo(obj);
+		ret = mutex_lock_interruptible(&bo->lock);
+		if (ret)
+			goto put_obj;
 		if (!bo->sliced) {
-			drm_gem_object_put(obj);
 			ret = -EINVAL;
-			goto free_ent;
+			goto unlock_bo;
 		}
 		if (bo->dbc->id != args->hdr.dbc_id) {
-			drm_gem_object_put(obj);
 			ret = -EINVAL;
-			goto free_ent;
+			goto unlock_bo;
 		}
 		/*
 		 * perf stats ioctl is called before wait ioctl is complete then
@@ -1858,7 +1859,12 @@ int qaic_perf_stats_bo_ioctl(struct drm_device *dev, void *data, struct drm_file
 						    bo->perf_stats.req_received_ts), 1000);
 		ent[i].queue_level_before = bo->perf_stats.queue_level_before;
 		ent[i].num_queue_element = bo->total_slice_nents;
+unlock_bo:
+		mutex_unlock(&bo->lock);
+put_obj:
 		drm_gem_object_put(obj);
+		if (ret)
+			goto free_ent;
 	}
 
 	if (copy_to_user(u64_to_user_ptr(args->data), ent, args->hdr.count * sizeof(*ent)))
-- 
2.50.1 (Apple Git-155)

Claude review: accel/qaic: Protect perf stats BO state with bo->lock

[Claude Code Review Bot]

Overall Series Review

Subject: accel/qaic: Protect perf stats BO state with bo->lock
Author: Shuvam Pandey <shuvampandey1@gmail.com>
Patches: 1
Reviewed: 2026-05-25T17:54:33.288980

---

This is a single-patch series that fixes a real TOCTOU race condition in the QAIC accelerator driver. The `qaic_perf_stats_bo_ioctl()` function reads `bo->sliced` and `bo->dbc` without holding `bo->lock`, while the detach path (`detach_slice_bo` -> `qaic_init_bo` / `qaic_unprepare_bo`) modifies these fields under `bo->lock`. The fix correctly acquires `bo->lock` before validating and reading the BO state.

The fix is **correct and well-structured**. The locking scope is appropriate -- it protects both the validation checks (`bo->sliced`, `bo->dbc->id`) and the perf stats reads (`bo->perf_stats.*`, `bo->total_slice_nents`). The error-path refactoring is clean: it collapses duplicate `drm_gem_object_put` calls into a single site, using the `unlock_bo` / `put_obj` label chain consistently.

One minor concern below, but overall this is a good fix.

---
Generated by Claude Code Patch Reviewer

Claude review: accel/qaic: Protect perf stats BO state with bo->lock

[Claude Code Review Bot]

Patch Review

**Race analysis: Correct.** The detach path in `qaic_detach_slice_bo_ioctl()` (line 1908) acquires `bo->lock` before calling `detach_slice_bo()`, which calls `qaic_unprepare_bo()` (sets `bo->dbc = NULL` at line 931) and `qaic_init_bo(bo, true)` (sets `bo->sliced = false` at line 685). Without the lock in the perf stats ioctl, a concurrent detach could:
1. Clear `bo->sliced` after the `!bo->sliced` check passes, leading to stale reads of `bo->perf_stats`.
2. Set `bo->dbc = NULL` after the `bo->sliced` check but before `bo->dbc->id` is read, causing a NULL pointer dereference.

**Locking scope: Correct.** The lock is held from before the `bo->sliced` check through the copy of all perf stats fields into `ent[i]`, which is exactly the critical section.

**Error path cleanup: Correct.** The old code had `drm_gem_object_put(obj)` duplicated in each error branch and on the success path. The new code consolidates into a single `drm_gem_object_put(obj)` at the `put_obj` label, with the `if (ret) goto free_ent` check happening after both unlock and put. This is cleaner and matches the pattern used in `qaic_detach_slice_bo_ioctl()`.

**Minor note on `mutex_lock_interruptible`:** Using `mutex_lock_interruptible` is consistent with how `bo->lock` is acquired throughout the file (lines 1034, 1225, 1908). This is the right choice for an ioctl path -- it allows the syscall to be interrupted by signals rather than blocking indefinitely.

**Fixes tag:** Points at commit `4ddf4ddfceb4` which added the `bo->dbc` validation check but didn't add the lock. This is accurate.

**No issues found.** The patch is correct and ready to merge.

---
Generated by Claude Code Patch Reviewer