From: Matthew R. Ochs Date: Wed, 21 Oct 2015 20:14:17 +0000 (-0500) Subject: cxlflash: Fix to prevent workq from accessing freed memory X-Git-Tag: Ubuntu-5.2.0-15.16~10354^2~17 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;h=d804621d0275da84caedcf2d6cf03fbe3c9ac3aa;p=mirror_ubuntu-eoan-kernel.git cxlflash: Fix to prevent workq from accessing freed memory The workq can process work in parallel with a remove event, leading to a condition where the workq handler can access freed memory. To remedy, the workq should be terminated prior to freeing memory. Move the termination call earlier in remove and use cancel_work_sync() instead of flush_work() as there is not a need to process any scheduled work when shutting down. Signed-off-by: Matthew R. Ochs Signed-off-by: Manoj N. Kumar Reviewed-by: Brian King Reviewed-by: Tomas Henzl Signed-off-by: James Bottomley --- diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c index 6b8b15917ae3..d0b99721c4f3 100644 --- a/drivers/scsi/cxlflash/main.c +++ b/drivers/scsi/cxlflash/main.c @@ -736,11 +736,11 @@ static void cxlflash_remove(struct pci_dev *pdev) /* Fall through */ case INIT_STATE_AFU: term_afu(cfg); + cancel_work_sync(&cfg->work_q); case INIT_STATE_PCI: pci_release_regions(cfg->dev); pci_disable_device(pdev); case INIT_STATE_NONE: - flush_work(&cfg->work_q); free_mem(cfg); scsi_host_put(cfg->host); break;