]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
drm/panthor: Fix UAF race between device unplug and FW event processing
authorKetil Johnsen <ketil.johnsen@arm.com>
Mon, 27 Oct 2025 14:02:15 +0000 (15:02 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 18 Dec 2025 13:02:49 +0000 (14:02 +0100)
commit6c1da9ae2c123a9ffda5375e64cc81f9ed3cc04a
tree18bee66e58f3adb644228e32eba1fb5d73ae7026
parent1ec19ea882841ff9de37d94c7db908af6a3ba325
drm/panthor: Fix UAF race between device unplug and FW event processing

[ Upstream commit 7051f6ba968fa69918d72cc26de4d6cf7ea05b90 ]

The function panthor_fw_unplug() will free the FW memory sections.
The problem is that there could still be pending FW events which are yet
not handled at this point. process_fw_events_work() can in this case try
to access said freed memory.

Simply call disable_work_sync() to both drain and prevent future
invocation of process_fw_events_work().

Signed-off-by: Ketil Johnsen <ketil.johnsen@arm.com>
Fixes: de85488138247 ("drm/panthor: Add the scheduler logical block")
Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patch.msgid.link/20251027140217.121274-1-ketil.johnsen@arm.com
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/panthor/panthor_sched.c