* [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal
@ 2025-08-08 11:09 Jacek Lawrynowicz
2025-08-08 16:56 ` Lizhi Hou
2025-09-01 10:39 ` Jacek Lawrynowicz
0 siblings, 2 replies; 3+ messages in thread
From: Jacek Lawrynowicz @ 2025-08-08 11:09 UTC (permalink / raw)
To: dri-devel
Cc: jeff.hugo, lizhi.hou, Karol Wachowski, stable, Jacek Lawrynowicz
From: Karol Wachowski <karol.wachowski@intel.com>
Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()
to ensure that no new recovery work items can be queued after device
removal has started. Previously, recovery work could be scheduled even
after canceling existing work, potentially leading to use-after-free
bugs if recovery accessed freed resources.
Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better
reflect its new behavior.
Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection")
Cc: <stable@vger.kernel.org> # v6.8+
Signed-off-by: Karol Wachowski <karol.wachowski@intel.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
---
drivers/accel/ivpu/ivpu_drv.c | 2 +-
drivers/accel/ivpu/ivpu_pm.c | 4 ++--
drivers/accel/ivpu/ivpu_pm.h | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
index 3d6d52492536a..3289751b47573 100644
--- a/drivers/accel/ivpu/ivpu_drv.c
+++ b/drivers/accel/ivpu/ivpu_drv.c
@@ -677,7 +677,7 @@ static void ivpu_bo_unbind_all_user_contexts(struct ivpu_device *vdev)
static void ivpu_dev_fini(struct ivpu_device *vdev)
{
ivpu_jobs_abort_all(vdev);
- ivpu_pm_cancel_recovery(vdev);
+ ivpu_pm_disable_recovery(vdev);
ivpu_pm_disable(vdev);
ivpu_prepare_for_reset(vdev);
ivpu_shutdown(vdev);
diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
index eacda1dbe8405..475ddc94f1cfe 100644
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -417,10 +417,10 @@ void ivpu_pm_init(struct ivpu_device *vdev)
ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
}
-void ivpu_pm_cancel_recovery(struct ivpu_device *vdev)
+void ivpu_pm_disable_recovery(struct ivpu_device *vdev)
{
drm_WARN_ON(&vdev->drm, delayed_work_pending(&vdev->pm->job_timeout_work));
- cancel_work_sync(&vdev->pm->recovery_work);
+ disable_work_sync(&vdev->pm->recovery_work);
}
void ivpu_pm_enable(struct ivpu_device *vdev)
diff --git a/drivers/accel/ivpu/ivpu_pm.h b/drivers/accel/ivpu/ivpu_pm.h
index 89b264cc0e3e7..a2aa7a27f32ef 100644
--- a/drivers/accel/ivpu/ivpu_pm.h
+++ b/drivers/accel/ivpu/ivpu_pm.h
@@ -25,7 +25,7 @@ struct ivpu_pm_info {
void ivpu_pm_init(struct ivpu_device *vdev);
void ivpu_pm_enable(struct ivpu_device *vdev);
void ivpu_pm_disable(struct ivpu_device *vdev);
-void ivpu_pm_cancel_recovery(struct ivpu_device *vdev);
+void ivpu_pm_disable_recovery(struct ivpu_device *vdev);
int ivpu_pm_suspend_cb(struct device *dev);
int ivpu_pm_resume_cb(struct device *dev);
--
2.45.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal
2025-08-08 11:09 [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal Jacek Lawrynowicz
@ 2025-08-08 16:56 ` Lizhi Hou
2025-09-01 10:39 ` Jacek Lawrynowicz
1 sibling, 0 replies; 3+ messages in thread
From: Lizhi Hou @ 2025-08-08 16:56 UTC (permalink / raw)
To: Jacek Lawrynowicz, dri-devel; +Cc: jeff.hugo, Karol Wachowski, stable
On 8/8/25 04:09, Jacek Lawrynowicz wrote:
> From: Karol Wachowski <karol.wachowski@intel.com>
>
> Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()
> to ensure that no new recovery work items can be queued after device
> removal has started. Previously, recovery work could be scheduled even
> after canceling existing work, potentially leading to use-after-free
> bugs if recovery accessed freed resources.
>
> Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better
> reflect its new behavior.
>
> Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection")
> Cc: <stable@vger.kernel.org> # v6.8+
> Signed-off-by: Karol Wachowski <karol.wachowski@intel.com>
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> ---
> drivers/accel/ivpu/ivpu_drv.c | 2 +-
> drivers/accel/ivpu/ivpu_pm.c | 4 ++--
> drivers/accel/ivpu/ivpu_pm.h | 2 +-
> 3 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 3d6d52492536a..3289751b47573 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
> @@ -677,7 +677,7 @@ static void ivpu_bo_unbind_all_user_contexts(struct ivpu_device *vdev)
> static void ivpu_dev_fini(struct ivpu_device *vdev)
> {
> ivpu_jobs_abort_all(vdev);
> - ivpu_pm_cancel_recovery(vdev);
> + ivpu_pm_disable_recovery(vdev);
> ivpu_pm_disable(vdev);
> ivpu_prepare_for_reset(vdev);
> ivpu_shutdown(vdev);
> diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
> index eacda1dbe8405..475ddc94f1cfe 100644
> --- a/drivers/accel/ivpu/ivpu_pm.c
> +++ b/drivers/accel/ivpu/ivpu_pm.c
> @@ -417,10 +417,10 @@ void ivpu_pm_init(struct ivpu_device *vdev)
> ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
> }
>
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev)
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev)
> {
> drm_WARN_ON(&vdev->drm, delayed_work_pending(&vdev->pm->job_timeout_work));
> - cancel_work_sync(&vdev->pm->recovery_work);
> + disable_work_sync(&vdev->pm->recovery_work);
> }
>
> void ivpu_pm_enable(struct ivpu_device *vdev)
> diff --git a/drivers/accel/ivpu/ivpu_pm.h b/drivers/accel/ivpu/ivpu_pm.h
> index 89b264cc0e3e7..a2aa7a27f32ef 100644
> --- a/drivers/accel/ivpu/ivpu_pm.h
> +++ b/drivers/accel/ivpu/ivpu_pm.h
> @@ -25,7 +25,7 @@ struct ivpu_pm_info {
> void ivpu_pm_init(struct ivpu_device *vdev);
> void ivpu_pm_enable(struct ivpu_device *vdev);
> void ivpu_pm_disable(struct ivpu_device *vdev);
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev);
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev);
Reviewed-by: Lizhi Hou <lizhi.hou@amd.com>
>
> int ivpu_pm_suspend_cb(struct device *dev);
> int ivpu_pm_resume_cb(struct device *dev);
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal
2025-08-08 11:09 [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal Jacek Lawrynowicz
2025-08-08 16:56 ` Lizhi Hou
@ 2025-09-01 10:39 ` Jacek Lawrynowicz
1 sibling, 0 replies; 3+ messages in thread
From: Jacek Lawrynowicz @ 2025-09-01 10:39 UTC (permalink / raw)
To: dri-devel; +Cc: jeff.hugo, lizhi.hou, Karol Wachowski, stable
Applied to drm-misc-fixes
On 8/8/2025 1:09 PM, Jacek Lawrynowicz wrote:
> From: Karol Wachowski <karol.wachowski@intel.com>
>
> Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()
> to ensure that no new recovery work items can be queued after device
> removal has started. Previously, recovery work could be scheduled even
> after canceling existing work, potentially leading to use-after-free
> bugs if recovery accessed freed resources.
>
> Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better
> reflect its new behavior.
>
> Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection")
> Cc: <stable@vger.kernel.org> # v6.8+
> Signed-off-by: Karol Wachowski <karol.wachowski@intel.com>
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
> ---
> drivers/accel/ivpu/ivpu_drv.c | 2 +-
> drivers/accel/ivpu/ivpu_pm.c | 4 ++--
> drivers/accel/ivpu/ivpu_pm.h | 2 +-
> 3 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 3d6d52492536a..3289751b47573 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
> @@ -677,7 +677,7 @@ static void ivpu_bo_unbind_all_user_contexts(struct ivpu_device *vdev)
> static void ivpu_dev_fini(struct ivpu_device *vdev)
> {
> ivpu_jobs_abort_all(vdev);
> - ivpu_pm_cancel_recovery(vdev);
> + ivpu_pm_disable_recovery(vdev);
> ivpu_pm_disable(vdev);
> ivpu_prepare_for_reset(vdev);
> ivpu_shutdown(vdev);
> diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
> index eacda1dbe8405..475ddc94f1cfe 100644
> --- a/drivers/accel/ivpu/ivpu_pm.c
> +++ b/drivers/accel/ivpu/ivpu_pm.c
> @@ -417,10 +417,10 @@ void ivpu_pm_init(struct ivpu_device *vdev)
> ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
> }
>
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev)
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev)
> {
> drm_WARN_ON(&vdev->drm, delayed_work_pending(&vdev->pm->job_timeout_work));
> - cancel_work_sync(&vdev->pm->recovery_work);
> + disable_work_sync(&vdev->pm->recovery_work);
> }
>
> void ivpu_pm_enable(struct ivpu_device *vdev)
> diff --git a/drivers/accel/ivpu/ivpu_pm.h b/drivers/accel/ivpu/ivpu_pm.h
> index 89b264cc0e3e7..a2aa7a27f32ef 100644
> --- a/drivers/accel/ivpu/ivpu_pm.h
> +++ b/drivers/accel/ivpu/ivpu_pm.h
> @@ -25,7 +25,7 @@ struct ivpu_pm_info {
> void ivpu_pm_init(struct ivpu_device *vdev);
> void ivpu_pm_enable(struct ivpu_device *vdev);
> void ivpu_pm_disable(struct ivpu_device *vdev);
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev);
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev);
>
> int ivpu_pm_suspend_cb(struct device *dev);
> int ivpu_pm_resume_cb(struct device *dev);
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-09-01 10:39 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-08 11:09 [PATCH] accel/ivpu: Prevent recovery work from being queued during device removal Jacek Lawrynowicz
2025-08-08 16:56 ` Lizhi Hou
2025-09-01 10:39 ` Jacek Lawrynowicz
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).