Re: [PATCH] drm/amdgpu: Change system_unbound_wq with system_dfl_wq

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing explicit cancellation of asynchronous interrupt work items (ih_soft_work, ih1_work, ih2_work) during device teardown, leading to a Use-After-Free.
--

--- Patch [1]: [PATCH] drm/amdgpu: Change system_unbound_wq with system_dfl_wq ---
commit 65cddcba7474a0c152afd7f127fd2e2ad98c63ac
Author: Marco Crivellari <marco.crivellari@suse.com>

drm/amdgpu: Change system_unbound_wq with system_dfl_wq

This commit replaces the deprecated system_unbound_wq with the newer
system_dfl_wq to avoid deprecation warnings. The patch aims to keep the
existing workqueue behavior intact.

> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c
> @@ -547,7 +547,7 @@ void amdgpu_irq_delegate(struct amdgpu_device *adev,
>  			 unsigned int num_dw)
>  {
>  	amdgpu_ih_ring_write(adev, &adev->irq.ih_soft, entry->iv_entry, num_dw);
> -	queue_work(system_unbound_wq, &adev->irq.ih_soft_work);
> +	queue_work(system_dfl_wq, &adev->irq.ih_soft_work);

[Severity: High]
This is a pre-existing issue, but since we are modifying the workqueue
submission here, does the teardown path leave ih_soft_work pending?

If a hardware interrupt fires just before device unbind or module unload,
adev->irq.ih_soft_work can be queued onto the global system workqueue. When
the driver proceeds with teardown, it frees the interrupt handler and the
ring buffers:

drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c:amdgpu_irq_fini_hw() {
        if (adev->irq.installed) {
                free_irq(adev->irq.irq, adev_to_drm(adev));
        ...
        amdgpu_ih_ring_fini(adev, &adev->irq.ih_soft);
}

However, it doesn't appear to explicitly call cancel_work_sync() for the
pending work items before freeing the adev structure. Could this result
in a use-after-free if the global workqueue asynchronously executes the
amdgpu_irq_handle_ih_soft() work item after the device memory is freed?

>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260707093812.109176-1-marco.crivellari@suse.com?part=1