In amdgpu_ras_fini(), cancel_delayed_work_sync() is currently called after ACA subsystems and locks are destroyed. If the delayed work (ras_counte_delay_work) runs concurrently during teardown, it can evaluate aca_handle_is_valid() right before remove_aca_handle() frees the handle and destroys its mutex, resulting in a use-after-free and locking violation.
Move cancel_delayed_work_sync() to the beginning of amdgpu_ras_fini() to ensure all pending work is flushed and stopped before resource deallocation starts. Signed-off-by: Sreeraj S Kurup <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index 764cd4950408..118716ad0437 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -4751,6 +4751,7 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (!adev->ras_enabled || !con) return 0; + cancel_delayed_work_sync(&con->ras_counte_delay_work); amdgpu_ras_critical_region_fini(adev); mutex_destroy(&con->critical_region_lock); @@ -4785,8 +4786,6 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (AMDGPU_RAS_GET_FEATURES(con->features)) amdgpu_ras_disable_all_features(adev, 0); - cancel_delayed_work_sync(&con->ras_counte_delay_work); - amdgpu_ras_set_context(adev, NULL); kfree(con); -- 2.54.0
