[PATCH] drm/xe: Use timer_shutdown_sync() to quiesce the self-rearming irq_fail timer

[Fan Wu]

The execlist port's irq_fail timer re-arms itself from its callback.
xe_execlist_port_destroy() currently uses timer_delete() to stop it.

timer_delete() neither waits for a callback already running on another
CPU nor prevents that callback from rearming the timer. Thus, a callback
can rearm irq_fail during teardown and a later invocation can access the
port after the drmm cleanup has freed it.

Use timer_shutdown_sync(), which waits for a running callback and
prevents further rearming. xe_execlist_port_destroy() does not hold
port->lock while shutting down the timer, so this cannot deadlock with
the callback.

This issue was found by an in-house static analysis tool and confirmed
by manual code review.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/gpu/drm/xe/xe_execlist.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_execlist.c b/drivers/gpu/drm/xe/xe_execlist.c
index 9fb99c038ea8..c1153dca8af3 100644
--- a/drivers/gpu/drm/xe/xe_execlist.c
+++ b/drivers/gpu/drm/xe/xe_execlist.c
@@ -287,7 +287,7 @@ struct xe_execlist_port *xe_execlist_port_create(struct xe_device *xe,
 
 void xe_execlist_port_destroy(struct xe_execlist_port *port)
 {
-	timer_delete(&port->irq_fail);
+	timer_shutdown_sync(&port->irq_fail);
 
 	/* Prevent an interrupt while we're destroying */
 	spin_lock_irq(&gt_to_xe(port->hwe->gt)->irq.lock);
-- 
2.34.1