linux-kernel - [PATCH 2/3] media: wave5: Fix kthread worker destruction in polling mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251203040935.2685490-3-xulin.sun@windriver.com>
Date: Wed,  3 Dec 2025 12:09:34 +0800
From: Xulin Sun <xulin.sun@...driver.com>
To: nas.chung@...psnmedia.com, jackson.lee@...psnmedia.com, mchehab@...nel.org
Cc: linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        xulin.sun@...driver.com
Subject: [PATCH 2/3] media: wave5: Fix kthread worker destruction in polling mode

Symptom:
  ------------[ cut here ]------------
  WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98
  Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...
  Call trace:
   kthread_destroy_worker+0x84/0x98
   wave5_vpu_remove+0xc8/0xe0 [wave5]
   platform_remove+0x30/0x58
  ...
  ---[ end trace 0000000000000000 ]---

Root cause:
  In polling mode (irq < 0), the driver uses hrtimer to periodically
  trigger wave5_vpu_timer_callback() which queues work via
  kthread_queue_work(). The kthread_destroy_worker() function validates
  that both work queues are empty:
  * WARN_ON(!list_empty(&worker->work_list))
  * WARN_ON(!list_empty(&worker->delayed_work_list))

  The original code called kthread_destroy_worker() before hrtimer_cancel(),
  creating a race condition where the timer could fire during worker
  destruction and queue new work, triggering the WARN_ON.

Fix:
  Reorder cleanup sequence:
  1) Cancel hrtimer first - stops the timer from firing and prevents
     new work from being queued
  2) Cancel current work with kthread_cancel_work_sync() - ensures any
     in-flight work completes
  3) Destroy worker - now both work queues are guaranteed empty, so
     kthread_destroy_worker() won't trigger warnings

Signed-off-by: Xulin Sun <xulin.sun@...driver.com>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 23aa3ab51a0e..0bcd48df49d0 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -352,8 +352,9 @@ static void wave5_vpu_remove(struct platform_device *pdev)
 	struct vpu_device *dev = dev_get_drvdata(&pdev->dev);
 
 	if (dev->irq < 0) {
-		kthread_destroy_worker(dev->worker);
 		hrtimer_cancel(&dev->hrtimer);
+		kthread_cancel_work_sync(&dev->work);
+		kthread_destroy_worker(dev->worker);
 	}
 
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
-- 
2.49.1