Commit 65c22519 authored by Ketil Johnsen's avatar Ketil Johnsen Committed by Liviu Dudau
Browse files

drm/panthor: disable async work during unplug 



A previous change, "drm/panthor: Fix UAF race between device unplug and
FW event processing", fixes a real issue where new work was unexpectedly
queued after cancellation. This was fixed by a disable instead.

Apply the same disable logic to other device level async work on device
unplug as a precaution.

Signed-off-by: default avatarKetil Johnsen <ketil.johnsen@arm.com>
Reviewed-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251029111412.924104-1-ketil.johnsen@arm.com


Signed-off-by: default avatarLiviu Dudau <liviu.dudau@arm.com>
parent 7051f6ba

drivers/gpu/drm/panthor/panthor_device.c

+1 −1
Original line number Diff line number Diff line
@@ -121,7 +121,7 @@ static void panthor_device_reset_cleanup(struct drm_device *ddev, void *data) 
{

	struct panthor_device *ptdev = container_of(ddev, struct panthor_device, base);



	cancel_work_sync(&ptdev->reset.work);

	disable_work_sync(&ptdev->reset.work);

	destroy_workqueue(ptdev->reset.wq);

}

drivers/gpu/drm/panthor/panthor_fw.c

+1 −1
Original line number Diff line number Diff line
@@ -1164,7 +1164,7 @@ void panthor_fw_unplug(struct panthor_device *ptdev) 
{

	struct panthor_fw_section *section;



	cancel_delayed_work_sync(&ptdev->fw->watchdog.ping_work);

	disable_delayed_work_sync(&ptdev->fw->watchdog.ping_work);



	if (!IS_ENABLED(CONFIG_PM) || pm_runtime_active(ptdev->base.dev)) {

		/* Make sure the IRQ handler cannot be called after that point. */

drivers/gpu/drm/panthor/panthor_sched.c

+2 −3
Original line number Diff line number Diff line
@@ -3877,8 +3877,9 @@ void panthor_sched_unplug(struct panthor_device *ptdev) 
{

	struct panthor_scheduler *sched = ptdev->scheduler;



	cancel_delayed_work_sync(&sched->tick_work);

	disable_delayed_work_sync(&sched->tick_work);

	disable_work_sync(&sched->fw_events_work);

	disable_work_sync(&sched->sync_upd_work);



	mutex_lock(&sched->lock);

	if (sched->pm.has_ref) {
@@ -3896,8 +3897,6 @@ static void panthor_sched_fini(struct drm_device *ddev, void *res) 
	if (!sched || !sched->csg_slot_count)

		return;



	cancel_delayed_work_sync(&sched->tick_work);



	if (sched->wq)

		destroy_workqueue(sched->wq);