diff options
| author | Matthew R. Ochs <mrochs@linux.vnet.ibm.com> | 2015-10-21 15:14:17 -0500 |
|---|---|---|
| committer | James Bottomley <JBottomley@Odin.com> | 2015-10-30 17:15:29 +0900 |
| commit | d804621d0275da84caedcf2d6cf03fbe3c9ac3aa (patch) | |
| tree | 80fb32ab0df611879ce55883125bcf5854b65584 /drivers | |
| parent | 8b5b1e871a736e93e6ef1b048c276975e7421e04 (diff) | |
| download | linux-d804621d0275da84caedcf2d6cf03fbe3c9ac3aa.tar.bz2 | |
cxlflash: Fix to prevent workq from accessing freed memory
The workq can process work in parallel with a remove event, leading
to a condition where the workq handler can access freed memory.
To remedy, the workq should be terminated prior to freeing memory. Move
the termination call earlier in remove and use cancel_work_sync() instead
of flush_work() as there is not a need to process any scheduled work when
shutting down.
Signed-off-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Manoj N. Kumar <manoj@linux.vnet.ibm.com>
Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
Reviewed-by: Tomas Henzl <thenzl@redhat.com>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/cxlflash/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c index 6b8b15917ae3..d0b99721c4f3 100644 --- a/drivers/scsi/cxlflash/main.c +++ b/drivers/scsi/cxlflash/main.c @@ -736,11 +736,11 @@ static void cxlflash_remove(struct pci_dev *pdev) /* Fall through */ case INIT_STATE_AFU: term_afu(cfg); + cancel_work_sync(&cfg->work_q); case INIT_STATE_PCI: pci_release_regions(cfg->dev); pci_disable_device(pdev); case INIT_STATE_NONE: - flush_work(&cfg->work_q); free_mem(cfg); scsi_host_put(cfg->host); break; |