i915_perf_add_config_ioctl() creates the dynamic sysfs entry for the OA config before allocating its id. If idr_alloc() fails, the error path drops the config reference via reg_err: without removing the sysfs entry - unlike the normal remove path, which does sysfs_remove_group() first. The leftover attributes point into the freed oa_config; kernfs only stores the attribute pointer, and show_dynamic_id() reaches the freed object via container_of (including the show() callback itself), so reading /sys/class/drm/cardX/metrics//id afterwards is a use-after-free. Remove the sysfs group on the idr_alloc() failure path, mirroring the remove ioctl's ordering (under metrics_lock). Found by static analysis. Cc: stable@vger.kernel.org Signed-off-by: Chengyu Liu --- drivers/gpu/drm/i915/i915_perf.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c index 19b82427aa41..40385f991abb 100644 --- a/drivers/gpu/drm/i915/i915_perf.c +++ b/drivers/gpu/drm/i915/i915_perf.c @@ -4716,6 +4716,7 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data, drm_dbg(&perf->i915->drm, "Failed to create sysfs entry for OA config\n"); err = oa_config->id; + sysfs_remove_group(perf->metrics_kobj, &oa_config->sysfs_metric); goto sysfs_err; } id = oa_config->id; -- 2.25.1