[PATCH] accel/ivpu: Prevent recovery work from being queued during device removal

[Lizhi Hou]

On 8/8/25 04:09, Jacek Lawrynowicz wrote:
> From: Karol Wachowski <karol.wachowski at intel.com>
>
> Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini()
> to ensure that no new recovery work items can be queued after device
> removal has started. Previously, recovery work could be scheduled even
> after canceling existing work, potentially leading to use-after-free
> bugs if recovery accessed freed resources.
>
> Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better
> reflect its new behavior.
>
> Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection")
> Cc: <stable at vger.kernel.org> # v6.8+
> Signed-off-by: Karol Wachowski <karol.wachowski at intel.com>
> Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz at linux.intel.com>
> ---
>   drivers/accel/ivpu/ivpu_drv.c | 2 +-
>   drivers/accel/ivpu/ivpu_pm.c  | 4 ++--
>   drivers/accel/ivpu/ivpu_pm.h  | 2 +-
>   3 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 3d6d52492536a..3289751b47573 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
> @@ -677,7 +677,7 @@ static void ivpu_bo_unbind_all_user_contexts(struct ivpu_device *vdev)
>   static void ivpu_dev_fini(struct ivpu_device *vdev)
>   {
>   	ivpu_jobs_abort_all(vdev);
> -	ivpu_pm_cancel_recovery(vdev);
> +	ivpu_pm_disable_recovery(vdev);
>   	ivpu_pm_disable(vdev);
>   	ivpu_prepare_for_reset(vdev);
>   	ivpu_shutdown(vdev);
> diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
> index eacda1dbe8405..475ddc94f1cfe 100644
> --- a/drivers/accel/ivpu/ivpu_pm.c
> +++ b/drivers/accel/ivpu/ivpu_pm.c
> @@ -417,10 +417,10 @@ void ivpu_pm_init(struct ivpu_device *vdev)
>   	ivpu_dbg(vdev, PM, "Autosuspend delay = %d\n", delay);
>   }
>   
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev)
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev)
>   {
>   	drm_WARN_ON(&vdev->drm, delayed_work_pending(&vdev->pm->job_timeout_work));
> -	cancel_work_sync(&vdev->pm->recovery_work);
> +	disable_work_sync(&vdev->pm->recovery_work);
>   }
>   
>   void ivpu_pm_enable(struct ivpu_device *vdev)
> diff --git a/drivers/accel/ivpu/ivpu_pm.h b/drivers/accel/ivpu/ivpu_pm.h
> index 89b264cc0e3e7..a2aa7a27f32ef 100644
> --- a/drivers/accel/ivpu/ivpu_pm.h
> +++ b/drivers/accel/ivpu/ivpu_pm.h
> @@ -25,7 +25,7 @@ struct ivpu_pm_info {
>   void ivpu_pm_init(struct ivpu_device *vdev);
>   void ivpu_pm_enable(struct ivpu_device *vdev);
>   void ivpu_pm_disable(struct ivpu_device *vdev);
> -void ivpu_pm_cancel_recovery(struct ivpu_device *vdev);
> +void ivpu_pm_disable_recovery(struct ivpu_device *vdev);
Reviewed-by: Lizhi Hou <lizhi.hou at amd.com>
>   
>   int ivpu_pm_suspend_cb(struct device *dev);
>   int ivpu_pm_resume_cb(struct device *dev);