net/ncsi: Disable the ncsi work before freeing the associated structure

BugLink: https://bugs.launchpad.net/bugs/2089884

[ Upstream commit a0ffa68c70b367358b2672cdab6fa5bc4c40de2c ]

The work function can run after the ncsi device is freed, resulting
in use-after-free bugs or kernel panic.

Fixes: 2d283bdd07 ("net/ncsi: Resource management")
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[koichiroden: the patch series "workqueue: Implement disable/enable_work()"
[1] is not included in this tree, so as a second-best option, call
cancel_work_sync() instead of disable_work_sync()
[1]: https://lore.kernel.org/lkml/20240221174333.700197-1-tj@kernel.org/]
Signed-off-by: Koichiro Den <koichiro.den@canonical.com>
Signed-off-by: Roxana Nicolescu <roxana.nicolescu@canonical.com>

This commit is contained in:

Eddie James

2024-09-25 10:55:23 -05:00

committed by

Mehmet Basaran

parent 1669a42a36

commit 898dbfb10f

1 changed files with 2 additions and 0 deletions

									
										net/ncsi/ncsi-manage.c
									
		+2
		
												View File
												
				@@ -1954,6 +1954,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)

					list_del_rcu(&ndp->node);

					spin_unlock_irqrestore(&ncsi_dev_lock, flags);

					cancel_work_sync(&ndp->work);

					kfree(ndp);

				}

				EXPORT_SYMBOL_GPL(ncsi_unregister_dev);