From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 42AE7363084 for ; Thu, 25 Jun 2026 14:20:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782397241; cv=none; b=Slm8c67IOHKNED9j5REEOPUtYt16wNbP1VM7PUJ61StFBOnFGEXPgUT/l866V4vbNsZ52tjCP9fJOHMb/1/2b2RbRyKGmIS5XDblaDvYn0Er6xGjmbitk6QFzUVTsebic7Zdu2WNfhgMPtRW3KUIRnrDMCxOgnGBhQag/KD+ByE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782397241; c=relaxed/simple; bh=VMFPhL9qWWY3o87HlGHRQAIC0bU8r7sxyyc2r8OQoEI=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=rEJ0B3mYAjBexWsZ0cgV5TmEfYSr9dXbDYZTp2rJ/CrxeFBV2Y9n6Ra8uw9A9X95Ter3psjs1GH7rEEjFuZV8P42oXNlVIn0LLo0d8N+VIVnB3ZzzzDU5dljvi3MPIXM5aY2IllBB1rEBDXlBSbAcyAyz9o67m8vkjc8IMS6NOY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=k2P5v4WE; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="k2P5v4WE" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1782397238; bh=VMFPhL9qWWY3o87HlGHRQAIC0bU8r7sxyyc2r8OQoEI=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=k2P5v4WEpgP1QbQKqad1URswH/dxla8HE4Ry69llrZsBSCIegasJ4WZANnIHEXsMY bvI7SFeNudB85wcT7C/VNA4bfrHlKN2+KqRqQ6R1NAEiS6TJ0U36iCi2cFMZL2SOyi A7dXqd+xBgL9gjN4RULHt0tJbUSSQCKXn3/AoUZYMDeg2WBje/ZG98svnqD/B9c0zQ UDAiDPPF+Inf5jNDeVseZd1/u79I9r9kGETgc2Aq4NSehnml5NIVNfqCBAZobA/EZR C7Cem2XPzIxBcIh2FevlcFG+3ig/ORszHlf+0yCulKFereAgkrTkgNM2B2xDfgF1Sr EtkoiJFpukqdA== Received: from fedora-2.home (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (prime256v1) server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id E016A17E0114; Thu, 25 Jun 2026 16:20:37 +0200 (CEST) Date: Thu, 25 Jun 2026 16:20:31 +0200 From: Boris Brezillon To: Steven Price , Liviu Dudau Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Nicolas Frattaroli , Chia-I Wu , Karunika Choo , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, sashiko-bot@kernel.org Subject: Re: [PATCH 03/11] drm/panthor: Fix UAF on works queued to panthor_cleanup_wq Message-ID: <20260625162031.31aa32c6@fedora-2.home> In-Reply-To: <20260625-panthor-misc-fixes-v1-3-b67ed973fea6@collabora.com> References: <20260625-panthor-misc-fixes-v1-0-b67ed973fea6@collabora.com> <20260625-panthor-misc-fixes-v1-3-b67ed973fea6@collabora.com> Organization: Collabora X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-redhat-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit On Thu, 25 Jun 2026 14:40:29 +0200 Boris Brezillon wrote: > If we don't drain the panthor_cleanup_wq before > unregistering/destroying the panthor_device, we might end up with > cleanup works that are executed after the device is gone. > > Add a drain_workqueue() call in panthor_device_unplug() to prevent > that. > > Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") > Fixes: 647810ec2476 ("drm/panthor: Add the MMU/VM logical block") > Reported-by: sashiko-bot@kernel.org > Closes: https://sashiko.dev/#/patchset/20260625-panthor-signal-from-irq-v5-0-8836a74e0ef9@collabora.com?part=2 > Signed-off-by: Boris Brezillon > --- > drivers/gpu/drm/panthor/panthor_device.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/panthor/panthor_device.c b/drivers/gpu/drm/panthor/panthor_device.c > index 0b25abebb803..a0774e28aa94 100644 > --- a/drivers/gpu/drm/panthor/panthor_device.c > +++ b/drivers/gpu/drm/panthor/panthor_device.c > @@ -101,6 +101,11 @@ void panthor_device_unplug(struct panthor_device *ptdev) > panthor_gpu_unplug(ptdev); > panthor_pwr_unplug(ptdev); > > + /* Make sure works queued to panthor_cleanup_wq are executed > + * before the device is destroyed. > + */ > + drain_workqueue(panthor_cleanup_wq); As shashiko pointed out[1], this doesn't work. __flush_workqueue() could work, but I'm actually considering moving those work to the panthor_mmu/panthor_scheduler, so we can easily call disable_work_sync() when the MMU/scheduler components are torn down. > + > pm_runtime_dont_use_autosuspend(ptdev->base.dev); > pm_runtime_put_sync_suspend(ptdev->base.dev); > > [1]https://sashiko.dev/#/patchset/20260625-panthor-misc-fixes-v1-0-b67ed973fea6@collabora.com?part=3