]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
accel/amdxdna: Fix notifier_wq lifetime race during device removal
authorLizhi Hou <lizhi.hou@amd.com>
Thu, 11 Jun 2026 05:51:49 +0000 (22:51 -0700)
committerLizhi Hou <lizhi.hou@amd.com>
Mon, 29 Jun 2026 17:34:48 +0000 (10:34 -0700)
commit5c72124186d6983e90b7c44229fcb768e3ff769a
tree437be167848fac981915315c4277a98831eadf78
parent1dbbc7f98cde1e2433c1b1617053ae2ffab00086
accel/amdxdna: Fix notifier_wq lifetime race during device removal

amdxdna_remove() destroys notifier_wq. If amdxdna_gem_obj_free() is
called after device removal, it may attempt to flush notifier_wq,
resulting in a use-after-free.

Fix the race by allocating notifier_wq with
drmm_alloc_ordered_workqueue(), so its lifetime is managed by DRM and
remains valid until all managed resources are released.

Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20260611055150.3070216-2-lizhi.hou@amd.com
drivers/accel/amdxdna/amdxdna_pci_drv.c