tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/panthor: Fix UAF race between device unplug and FW event processing

The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().

Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251027140217.121274-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>

authored by

Ketil Johnsen and committed by
Liviu Dudau 7051f6ba 94a6d20f

+1
+1
drivers/gpu/drm/panthor/panthor_sched.c
··· 3878 3878 struct panthor_scheduler *sched = ptdev->scheduler; 3879 3879 3880 3880 cancel_delayed_work_sync(&sched->tick_work); 3881 + disable_work_sync(&sched->fw_events_work); 3881 3882 3882 3883 mutex_lock(&sched->lock); 3883 3884 if (sched->pm.has_ref) {