Re: [PATCH v2] s390/tape: cancel delayed work on device removal

[Heiko Carstens <hca@linux.ibm.com>]

Jan, this is for you, I would guess.

[full quote below]

On Mon, Oct 19, 2026 at 10:56:06PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> tape_generic_remove() drops the device reference without cancelling
> the pending delayed work tape_dnr. If tape_delayed_next_request() is
> still scheduled or running when the struct is freed on the final
> reference drop, the work function dereferences freed memory.
> 
> The cancel cannot go in tape_put_device() because that function is
> called from atomic context (under get_ccwdev_lock with interrupts
> disabled) and from within the work function itself, both of which
> would deadlock or sleep in atomic context with cancel_delayed_work_sync().
> 
> Add cancel_delayed_work_sync() in tape_generic_remove() after
> dev_set_drvdata() clears the device pointer and before dropping the
> final reference. At this point the spinlock is not held and the device
> is no longer reachable for new operations.
> 
> Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v2:
> - Moved cancel from tape_put_device() to tape_generic_remove().
>   tape_put_device() is called from atomic context (under spinlock with
>   IRQs disabled) and from within tape_delayed_next_request() itself,
>   so cancel_delayed_work_sync() there would deadlock or sleep in atomic.
>   tape_generic_remove() runs in process context with no locks held.
>  drivers/s390/char/tape_core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
> index bd8e3deb11993..cb5db2cabd21a 100644
> --- a/drivers/s390/char/tape_core.c
> +++ b/drivers/s390/char/tape_core.c
> @@ -662,6 +662,7 @@ tape_generic_remove(struct ccw_device *cdev)
>  	if (device) {
>  		sysfs_remove_group(&cdev->dev.kobj, &tape_attr_group);
>  		dev_set_drvdata(&cdev->dev, NULL);
> +		cancel_delayed_work_sync(&device->tape_dnr);
>  		tape_put_device(device);
>  	}
>  }
> -- 
> 2.47.3
>