Re: [PATCH v2] s390/tape: cancel delayed work on device removal

[sashiko-bot@kernel.org]

> From: Tristan Madani <tristan@talencesecurity.com>
> 
> tape_generic_remove() drops the device reference without cancelling
> the pending delayed work tape_dnr. If tape_delayed_next_request() is
> still scheduled or running when the struct is freed on the final
> reference drop, the work function dereferences freed memory.
> 
> The cancel cannot go in tape_put_device() because that function is
> called from atomic context (under get_ccwdev_lock with interrupts
> disabled) and from within the work function itself, both of which
> would deadlock or sleep in atomic context with cancel_delayed_work_sync().
> 
> Add cancel_delayed_work_sync() in tape_generic_remove() after
> dev_set_drvdata() clears the device pointer and before dropping the
> final reference. At this point the spinlock is not held and the device
> is no longer reachable for new operations.
> 
> Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Tristan Madani <tristan@talencesecurity.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019225606.1864082-1-tristmd@gmail.com?part=1