| Message ID | 20230309183812.299349-1-zyytlz.wz@163.com |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: qla4xxx: Fix use after free bug in da9150_charger_remove due to race condition | expand |
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 005502125b27..d530cc853f43 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -9001,6 +9001,7 @@ static void qla4xxx_remove_adapter(struct pci_dev *pdev) if (!pci_is_enabled(pdev)) return; + cancel_work_sync(&ha->dpc_work); ha = pci_get_drvdata(pdev); if (is_qla40XX(ha))
In qla4xxx_probe_adapter, &ha->dpc_work is bound with qla4xxx_do_dpc. qla4xxx_post_aen_work may be called to start the work. If we remove the module which will call qla4xxx_remove_adapter to make cleanup, there may be a unfinished work. The possible sequence is as follows: Fix it by canceling the work before cleanup in qla4xxx_remove_adapter CPU0 CPUc1 |qla4xxx_do_dpc qla4xxx_remove_adapter| scsi_remove_host | kfree(ha->host) | | | iscsi_host_for_each_session | //use ha->host Fixes: afaf5a2d341d ("[SCSI] Initial Commit of qla4xxx") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> --- drivers/scsi/qla4xxx/ql4_os.c | 1 + 1 file changed, 1 insertion(+)