accel/ivpu: Fix locking order in ivpu_cmdq_destroy_ioctl
authorKarol Wachowski <karol.wachowski@intel.com>
Tue, 7 Jan 2025 17:32:33 +0000 (18:32 +0100)
committerJacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Thu, 9 Jan 2025 08:35:45 +0000 (09:35 +0100)
Fix deadlock caused by inversed locking order in ivpu_job_submit()
and ivpu_cmdq_destroy_ioctl(). Both functions operate locking
file_priv->lock and submitted_jobs_lock.

Unlock file_priv->lock in ivpu_cmdq_destroy_ioctl() before calling
ivpu_cmdq_abort_all_jobs() function which locks submitted_jobs_lock.
That way locking order is maintained:
 1) global submitted_jobs_lock first
 2) per context file_priv->lock second

Signed-off-by: Karol Wachowski <karol.wachowski@intel.com>
Signed-off-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Reviewed-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Signed-off-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250107173238.381120-11-maciej.falkowski@linux.intel.com
drivers/accel/ivpu/ivpu_job.c

index 37ea92eb4b25ec594f9fce5c68ae3984fdf5fb77..c694822a14bf45d68250189105227db6b3d4f898 100644 (file)
@@ -883,7 +883,7 @@ int ivpu_cmdq_destroy_ioctl(struct drm_device *dev, void *data, struct drm_file
        struct drm_ivpu_cmdq_destroy *args = data;
        struct ivpu_cmdq *cmdq;
        u32 cmdq_id;
-       int ret = 0;
+       int ret;
 
        if (!ivpu_is_capable(vdev, DRM_IVPU_CAP_MANAGE_CMDQ))
                return -ENODEV;
@@ -893,13 +893,16 @@ int ivpu_cmdq_destroy_ioctl(struct drm_device *dev, void *data, struct drm_file
        cmdq = xa_load(&file_priv->cmdq_xa, args->cmdq_id);
        if (!cmdq || cmdq->is_legacy) {
                ret = -ENOENT;
-               goto unlock;
+               goto err_unlock;
        }
 
        cmdq_id = cmdq->id;
        ivpu_cmdq_destroy(file_priv, cmdq);
+       mutex_unlock(&file_priv->lock);
        ivpu_cmdq_abort_all_jobs(vdev, file_priv->ctx.id, cmdq_id);
-unlock:
+       return 0;
+
+err_unlock:
        mutex_unlock(&file_priv->lock);
        return ret;
 }