In amdgpu_ras_fini(), cancel_delayed_work_sync() is currently called after ACA subsystems and locks are destroyed. Similarly, in amdgpu_ras_recovery_fini(), mutex_destroy(&con->page_rsv_lock) is called before cancel_delayed_work_sync(&con->page_retirement_dwork).
If delayed work runs while teardown is in progress, it can attempt to acquire destroyed mutexes, leading to locking violations and potential use-after-free conditions. Fix this by moving cancel_delayed_work_sync() and cancel_work_sync() prior to mutex destruction and subsystem teardown in both functions, ensuring all pending work is synchronously canceled while locks remain intact. Signed-off-by: Sreeraj S Kurup <[email protected]> --- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c index 764cd4950408..23b9844d9f1c 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c @@ -3994,15 +3994,14 @@ static int amdgpu_ras_recovery_fini(struct amdgpu_device *adev) if (con->page_retirement_thread) kthread_stop(con->page_retirement_thread); + cancel_work_sync(&con->recovery_work); + cancel_delayed_work_sync(&con->page_retirement_dwork); + atomic_set(&con->page_retirement_req_cnt, 0); atomic_set(&con->poison_creation_count, 0); mutex_destroy(&con->page_rsv_lock); - cancel_work_sync(&con->recovery_work); - - cancel_delayed_work_sync(&con->page_retirement_dwork); - amdgpu_ras_ecc_log_fini(&con->umc_ecc_log); mutex_lock(&con->recovery_lock); @@ -4751,6 +4750,8 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (!adev->ras_enabled || !con) return 0; + cancel_delayed_work_sync(&con->ras_counte_delay_work); + amdgpu_ras_critical_region_fini(adev); mutex_destroy(&con->critical_region_lock); @@ -4785,8 +4786,6 @@ int amdgpu_ras_fini(struct amdgpu_device *adev) if (AMDGPU_RAS_GET_FEATURES(con->features)) amdgpu_ras_disable_all_features(adev, 0); - cancel_delayed_work_sync(&con->ras_counte_delay_work); - amdgpu_ras_set_context(adev, NULL); kfree(con); -- 2.54.0
