Re: [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal

[Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>]

Applied to drm-misc-fixes

On 8/8/2025 1:09 PM, Jacek Lawrynowicz wrote:
> From: Karol Wachowski <karol.wachowski@intel.com>
> 
> Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()
> to ensure that no new recovery work items can be queued after device
> removal has started. Previously, recovery work could be scheduled even
> after canceling existing work, potentially leading to use-after-free
> bugs if recovery accessed freed resources.
> 
> Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better
> reflect its new behavior.
> 
> Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection")
> Cc: <stable@vger.kernel.org> # v6.8+
> Signed-off-by: Karol Wachowski <karol.wachowski@intel.com>
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> ---
>  drivers/accel/ivpu/ivpu_drv.c | 2 +-
>  drivers/accel/ivpu/ivpu_pm.c  | 4 ++--
>  drivers/accel/ivpu/ivpu_pm.h  | 2 +-
>  3 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 3d6d52492536a..3289751b47573 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
> @@ -677,7 +677,7 @@ static void ivpu_bo_unbind_all_user_contexts(struct ivpu_device *vdev)
>  static void ivpu_dev_fini(struct ivpu_device *vdev)
>  {
>  	ivpu_jobs_abort_all(vdev);
> -	ivpu_pm_cancel_recovery(vdev);
> +	ivpu_pm_disable_recovery(vdev);
>  	ivpu_pm_disable(vdev);
>  	ivpu_prepare_for_reset(vdev);
>  	ivpu_shutdown(vdev);
> diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
> index eacda1dbe8405..475ddc94f1cfe 100644
> --- a/drivers/accel/ivpu/ivpu_pm.c
> +++ b/drivers/accel/ivpu/ivpu_pm.c
> @@ -417,10 +417,10 @@ void ivpu_pm_init(struct ivpu_device *vdev)
>  	ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
>  }
>  
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev)
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev)
>  {
>  	drm_WARN_ON(&vdev->drm, delayed_work_pending(&vdev->pm->job_timeout_work));
> -	cancel_work_sync(&vdev->pm->recovery_work);
> +	disable_work_sync(&vdev->pm->recovery_work);
>  }
>  
>  void ivpu_pm_enable(struct ivpu_device *vdev)
> diff --git a/drivers/accel/ivpu/ivpu_pm.h b/drivers/accel/ivpu/ivpu_pm.h
> index 89b264cc0e3e7..a2aa7a27f32ef 100644
> --- a/drivers/accel/ivpu/ivpu_pm.h
> +++ b/drivers/accel/ivpu/ivpu_pm.h
> @@ -25,7 +25,7 @@ struct ivpu_pm_info {
>  void ivpu_pm_init(struct ivpu_device *vdev);
>  void ivpu_pm_enable(struct ivpu_device *vdev);
>  void ivpu_pm_disable(struct ivpu_device *vdev);
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev);
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev);
>  
>  int ivpu_pm_suspend_cb(struct device *dev);
>  int ivpu_pm_resume_cb(struct device *dev);