github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

accel/qaic: Cancel Sahara read data work on removal

Browse Source 
Sahara removal cancels fw_work and dump_work, but leaves read_data_work
pending or running. The latter accesses the firmware and the device-managed
context and transfer buffer, which are released during removal.

Cancel read_data_work after fw_work, which can schedule it, and before
releasing the firmware. The MHI core suspends and resets the channels
before invoking the driver's remove callback.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code. The same omission was also reported by the
Sashiko bot while reviewing the Sahara relocation series.

Fixes: 7fb19ea1ec ("accel/qaic: Support the new READ_DATA implementation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
[jhugo: reorder cancel_work_sync() calls]
Signed-off-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20260917192512.56205-1-mhun512@gmail.com
This commit is contained in:
Myeonghun Pak 2026-09-17 15:25:12 -04:00 committed by Jeff Hugo
parent 725953d4da
commit 018e5a0219
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/accel/qaic/sahara.c
View File

@ -881,6 +881,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev)
cancel_work_sync(&context->fw_work);
cancel_work_sync(&context->dump_work);
cancel_work_sync(&context->read_data_work);
vfree(context->mem_dump);
sahara_release_image(context);
mhi_unprepare_from_transfer(mhi_dev);