[PATCH] drm/lima: disable the recover work before tearing down the scheduler

[Myeonghun Pak]

GP and GP MMU interrupt handlers queue pipe->recover_work to grow a
faulting task's heap and resume it. lima_device_fini() tears down the
pipes before freeing these interrupts, without cancelling the work.
It can therefore run during or after drm_sched_fini(), access hardware
after clocks are disabled, or use the freed lima_device.

Disable the work before drm_sched_fini(). Use disable_work_sync()
because interrupts can still queue it until lima_fini_ip() frees them.
Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: 2081e8dcf1ee ("drm/lima: recover task by enlarging heap buffer")
Cc: stable@xxxxxxxxxxxxxxx # v6.10+
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

---

diff --git a/drivers/gpu/drm/lima/lima_sched.c b/drivers/gpu/drm/lima/lima_sched.c
index 9a1e6b9ecbe5..7a9ccca1291a 100644
--- a/drivers/gpu/drm/lima/lima_sched.c
+++ b/drivers/gpu/drm/lima/lima_sched.c
@@ -539,6 +539,7 @@ int lima_sched_pipe_init(struct lima_sched_pipe *pipe, const char *name)
 
 void lima_sched_pipe_fini(struct lima_sched_pipe *pipe)
 {
+	disable_work_sync(&pipe->recover_work);
 	drm_sched_fini(&pipe->base);
 }
 

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0