Re: [PATCH V3 2/3] accel/amdxdna: Fix notifier_wq lifetime race during device removal

[Mario Limonciello <superm1@kernel.org>]

On 6/11/26 00:51, Lizhi Hou wrote:
> amdxdna_remove() destroys notifier_wq. If amdxdna_gem_obj_free() is
> called after device removal, it may attempt to flush notifier_wq,
> resulting in a use-after-free.
> 
> Fix the race by allocating notifier_wq with
> drmm_alloc_ordered_workqueue(), so its lifetime is managed by DRM and
> remains valid until all managed resources are released.
> 
> Fixes: e486147c912f ("accel/amdxdna: Add BO import and export")
> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
> ---
>   drivers/accel/amdxdna/amdxdna_pci_drv.c | 12 ++++--------
>   1 file changed, 4 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/accel/amdxdna/amdxdna_pci_drv.c b/drivers/accel/amdxdna/amdxdna_pci_drv.c
> index 470bf4fc744b..b943c06a451e 100644
> --- a/drivers/accel/amdxdna/amdxdna_pci_drv.c
> +++ b/drivers/accel/amdxdna/amdxdna_pci_drv.c
> @@ -389,9 +389,9 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>   	if (ret)
>   		return ret;
>   
> -	xdna->notifier_wq = alloc_ordered_workqueue("notifier_wq", WQ_MEM_RECLAIM);
> -	if (!xdna->notifier_wq) {
> -		ret = -ENOMEM;
> +	xdna->notifier_wq = drmm_alloc_ordered_workqueue(ddev, "notifier_wq", WQ_MEM_RECLAIM);
> +	if (IS_ERR(xdna->notifier_wq)) {
> +		ret = PTR_ERR(xdna->notifier_wq);
>   		goto iommu_fini;
>   	}
>   
> @@ -400,7 +400,7 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>   	mutex_unlock(&xdna->dev_lock);
>   	if (ret) {
>   		XDNA_ERR(xdna, "Hardware init failed, ret %d", ret);
> -		goto destroy_notifier_wq;
> +		goto iommu_fini;
>   	}
>   
>   	ret = amdxdna_sysfs_init(xdna);
> @@ -424,8 +424,6 @@ static int amdxdna_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>   	mutex_lock(&xdna->dev_lock);
>   	xdna->dev_info->ops->fini(xdna);
>   	mutex_unlock(&xdna->dev_lock);
> -destroy_notifier_wq:
> -	destroy_workqueue(xdna->notifier_wq);
>   iommu_fini:
>   	amdxdna_iommu_fini(xdna);
>   	return ret;
> @@ -436,8 +434,6 @@ static void amdxdna_remove(struct pci_dev *pdev)
>   	struct amdxdna_dev *xdna = pci_get_drvdata(pdev);
>   	struct amdxdna_client *client;
>   
> -	destroy_workqueue(xdna->notifier_wq);
> -
>   	drm_dev_unplug(&xdna->ddev);
>   	amdxdna_sysfs_fini(xdna);
>