diff options
| author | Fan Wu <fanwu01@zju.edu.cn> | 2026-08-06 13:01:27 +0000 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-08-11 16:57:33 -0300 |
| commit | a7100601aa1a39f799a566acce10db20eaf4b7f2 (patch) | |
| tree | 75d5558e6b0fe7e61e2b2fcd57d24b0bea0cc138 /drivers/infiniband | |
| parent | ecbe7d36dc2de07e5dfbb4a8ff5b315ab43de820 (diff) | |
| download | linux-next-a7100601aa1a39f799a566acce10db20eaf4b7f2.tar.gz linux-next-a7100601aa1a39f799a566acce10db20eaf4b7f2.zip | |
RDMA/cxgb4: Cancel reg_work before freeing device on remove
c4iw_uld_state_change() queues reg_work to register the RDMA device.
c4iw_remove() can free ctx->dev while this work is pending or running,
leaving c4iw_register_device() accessing the freed device.
Cancel reg_work before removing the device. The registration work can
tear down ctx->dev when registration fails, so do not unregister or
deallocate it again in that case.
This issue was found by an in-house static analysis tool.
Fixes: 1c8f1da5d851 ("iw_cxgb4: Fix possible circular dependency locking warning")
Link: https://patch.msgid.link/r/20260806130128.465460-1-fanwu01@zju.edu.cn
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/cxgb4/device.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c index 102c5646b9ed..c1815972aecf 100644 --- a/drivers/infiniband/hw/cxgb4/device.c +++ b/drivers/infiniband/hw/cxgb4/device.c @@ -951,6 +951,12 @@ void c4iw_dealloc(struct uld_ctx *ctx) static void c4iw_remove(struct uld_ctx *ctx) { pr_debug("c4iw_dev %p\n", ctx->dev); + + /* c4iw_register_device() may still be using ctx->dev. */ + cancel_work_sync(&ctx->reg_work); + if (!ctx->dev) + return; + debugfs_remove_recursive(ctx->dev->debugfs_root); c4iw_unregister_device(ctx->dev); c4iw_dealloc(ctx); |