From 7a39b9856acccc8e9b05845ca2bf62494fcd3dfa Mon Sep 17 00:00:00 2001 From: Mikko Perttunen Date: Tue, 9 Jun 2026 17:09:17 +0900 Subject: [PATCH] gpu: host1x: Wait for timeout worker completion on channel free cdma_timeout_destroy() used cancel_delayed_work() to cancel pending timeout work when destroying the CDMA. Usually this is fine, but there is a narrow race condition where the timeout handler has started execution but has not taken cdma->lock; the channel is freed causing cdma_stop to take cdma->lock and flush the channel; host1x_cdma_deinit then proceeds with deinitializing cdma while the handler is waiting to take cdma->lock. Therefore change cdma_timeout_destroy to use cancel_delayed_work_sync instead to ensure any pending timeout work completes before proceeding. Signed-off-by: Mikko Perttunen Signed-off-by: Thierry Reding Link: https://patch.msgid.link/20260609-b4-host1x-small-fixes-a-v1-1-7c1131c0b3ad@nvidia.com --- drivers/gpu/host1x/hw/cdma_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/host1x/hw/cdma_hw.c b/drivers/gpu/host1x/hw/cdma_hw.c index 3f3f0018eee0..ab714d221120 100644 --- a/drivers/gpu/host1x/hw/cdma_hw.c +++ b/drivers/gpu/host1x/hw/cdma_hw.c @@ -355,7 +355,7 @@ static int cdma_timeout_init(struct host1x_cdma *cdma) static void cdma_timeout_destroy(struct host1x_cdma *cdma) { if (cdma->timeout.initialized) - cancel_delayed_work(&cdma->timeout.wq); + cancel_delayed_work_sync(&cdma->timeout.wq); cdma->timeout.initialized = false; }