[PATCH v2] s390/tape: cancel delayed work on device removal

[PATCH v2] s390/tape: cancel delayed work on device removal

[Tristan Madani]

From: Tristan Madani <tristan@talencesecurity.com>

tape_generic_remove() drops the device reference without cancelling
the pending delayed work tape_dnr. If tape_delayed_next_request() is
still scheduled or running when the struct is freed on the final
reference drop, the work function dereferences freed memory.

The cancel cannot go in tape_put_device() because that function is
called from atomic context (under get_ccwdev_lock with interrupts
disabled) and from within the work function itself, both of which
would deadlock or sleep in atomic context with cancel_delayed_work_sync().

Add cancel_delayed_work_sync() in tape_generic_remove() after
dev_set_drvdata() clears the device pointer and before dropping the
final reference. At this point the spinlock is not held and the device
is no longer reachable for new operations.

Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v2:
- Moved cancel from tape_put_device() to tape_generic_remove().
  tape_put_device() is called from atomic context (under spinlock with
  IRQs disabled) and from within tape_delayed_next_request() itself,
  so cancel_delayed_work_sync() there would deadlock or sleep in atomic.
  tape_generic_remove() runs in process context with no locks held.
 drivers/s390/char/tape_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index bd8e3deb11993..cb5db2cabd21a 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -662,6 +662,7 @@ tape_generic_remove(struct ccw_device *cdev)
 	if (device) {
 		sysfs_remove_group(&cdev->dev.kobj, &tape_attr_group);
 		dev_set_drvdata(&cdev->dev, NULL);
+		cancel_delayed_work_sync(&device->tape_dnr);
 		tape_put_device(device);
 	}
 }
-- 
2.47.3

Re: [PATCH v2] s390/tape: cancel delayed work on device removal

[sashiko-bot]

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> tape_generic_remove() drops the device reference without cancelling
> the pending delayed work tape_dnr. If tape_delayed_next_request() is
> still scheduled or running when the struct is freed on the final
> reference drop, the work function dereferences freed memory.
> 
> The cancel cannot go in tape_put_device() because that function is
> called from atomic context (under get_ccwdev_lock with interrupts
> disabled) and from within the work function itself, both of which
> would deadlock or sleep in atomic context with cancel_delayed_work_sync().
> 
> Add cancel_delayed_work_sync() in tape_generic_remove() after
> dev_set_drvdata() clears the device pointer and before dropping the
> final reference. At this point the spinlock is not held and the device
> is no longer reachable for new operations.
> 
> Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019225606.1864082-1-tristmd@gmail.com?part=1

Re: [PATCH v2] s390/tape: cancel delayed work on device removal

[Heiko Carstens]

Jan, this is for you, I would guess.

[full quote below]

On Mon, Oct 19, 2026 at 10:56:06PM +0000, Tristan Madani wrote:
> From: Tristan Madani <tristan@talencesecurity.com>
> 
> tape_generic_remove() drops the device reference without cancelling
> the pending delayed work tape_dnr. If tape_delayed_next_request() is
> still scheduled or running when the struct is freed on the final
> reference drop, the work function dereferences freed memory.
> 
> The cancel cannot go in tape_put_device() because that function is
> called from atomic context (under get_ccwdev_lock with interrupts
> disabled) and from within the work function itself, both of which
> would deadlock or sleep in atomic context with cancel_delayed_work_sync().
> 
> Add cancel_delayed_work_sync() in tape_generic_remove() after
> dev_set_drvdata() clears the device pointer and before dropping the
> final reference. At this point the spinlock is not held and the device
> is no longer reachable for new operations.
> 
> Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
> ---
> Changes in v2:
> - Moved cancel from tape_put_device() to tape_generic_remove().
>   tape_put_device() is called from atomic context (under spinlock with
>   IRQs disabled) and from within tape_delayed_next_request() itself,
>   so cancel_delayed_work_sync() there would deadlock or sleep in atomic.
>   tape_generic_remove() runs in process context with no locks held.
>  drivers/s390/char/tape_core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
> index bd8e3deb11993..cb5db2cabd21a 100644
> --- a/drivers/s390/char/tape_core.c
> +++ b/drivers/s390/char/tape_core.c
> @@ -662,6 +662,7 @@ tape_generic_remove(struct ccw_device *cdev)
>  	if (device) {
>  		sysfs_remove_group(&cdev->dev.kobj, &tape_attr_group);
>  		dev_set_drvdata(&cdev->dev, NULL);
> +		cancel_delayed_work_sync(&device->tape_dnr);
>  		tape_put_device(device);
>  	}
>  }
> -- 
> 2.47.3
>