[PATCH] scsi: ppa: cancel delayed work before freeing on detach

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

ppa_detach() frees the ppa_struct without cancelling the pending
delayed work ppa_tq. If ppa_interrupt() is still scheduled or running
when the struct is freed, the work function accesses freed memory via
container_of().

Add cancel_delayed_work_sync() before teardown, matching the pattern
in the sibling imm driver.

Fixes: c4028958b6eca ("WorkStruct: make allyesconfig")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/scsi/ppa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/ppa.c b/drivers/scsi/ppa.c
index 8a4e910d5758f..7f4b2a4157725 100644
--- a/drivers/scsi/ppa.c
+++ b/drivers/scsi/ppa.c
@@ -1136,6 +1136,7 @@ static void ppa_detach(struct parport *pb)
 	ppa_struct *dev;
 	list_for_each_entry(dev, &ppa_hosts, list) {
 		if (dev->dev->port == pb) {
+			cancel_delayed_work_sync(&dev->ppa_tq);
 			list_del_init(&dev->list);
 			scsi_remove_host(dev->host);
 			scsi_host_put(dev->host);
-- 
2.47.3