From 018e5a021904707b91cecd77e7f759937ec04643 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Thu, 17 Sep 2026 15:25:12 -0400 Subject: [PATCH] accel/qaic: Cancel Sahara read data work on removal Sahara removal cancels fw_work and dump_work, but leaves read_data_work pending or running. The latter accesses the firmware and the device-managed context and transfer buffer, which are released during removal. Cancel read_data_work after fw_work, which can schedule it, and before releasing the firmware. The MHI core suspends and resets the channels before invoking the driver's remove callback. This issue was identified during our ongoing static-analysis research while reviewing kernel code. The same omission was also reported by the Sashiko bot while reviewing the Sahara relocation series. Fixes: 7fb19ea1ec6a ("accel/qaic: Support the new READ_DATA implementation") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/ Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Reviewed-by: Jeff Hugo [jhugo: reorder cancel_work_sync() calls] Signed-off-by: Jeff Hugo Link: https://patch.msgid.link/20260917192512.56205-1-mhun512@gmail.com --- drivers/accel/qaic/sahara.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/accel/qaic/sahara.c b/drivers/accel/qaic/sahara.c index 8476be9b9148..e951181e424f 100644 --- a/drivers/accel/qaic/sahara.c +++ b/drivers/accel/qaic/sahara.c @@ -881,6 +881,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev) cancel_work_sync(&context->fw_work); cancel_work_sync(&context->dump_work); + cancel_work_sync(&context->read_data_work); vfree(context->mem_dump); sahara_release_image(context); mhi_unprepare_from_transfer(mhi_dev);