diff options
| author | Ketil Johnsen <ketil.johnsen@arm.com> | 2025-10-27 15:02:15 +0100 |
|---|---|---|
| committer | Liviu Dudau <liviu.dudau@arm.com> | 2025-11-03 14:25:21 +0000 |
| commit | 7051f6ba968fa69918d72cc26de4d6cf7ea05b90 (patch) | |
| tree | 8b2b663848705170390db2f9da1547b921d4b185 | |
| parent | 94a6d20feadbbe24e8a7b1c56394789ea5358fcc (diff) | |
drm/panthor: Fix UAF race between device unplug and FW event processing
The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.
Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().
Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251027140217.121274-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
| -rw-r--r-- | drivers/gpu/drm/panthor/panthor_sched.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/gpu/drm/panthor/panthor_sched.c b/drivers/gpu/drm/panthor/panthor_sched.c index c9c6bfe47b76..3507e189082a 100644 --- a/drivers/gpu/drm/panthor/panthor_sched.c +++ b/drivers/gpu/drm/panthor/panthor_sched.c @@ -3878,6 +3878,7 @@ void panthor_sched_unplug(struct panthor_device *ptdev) struct panthor_scheduler *sched = ptdev->scheduler; cancel_delayed_work_sync(&sched->tick_work); + disable_work_sync(&sched->fw_events_work); mutex_lock(&sched->lock); if (sched->pm.has_ref) { |