[PATCH] accel/qaic: Cancel Sahara read data work on removal

[PATCH] accel/qaic: Cancel Sahara read data work on removal

[Myeonghun Pak]

Sahara removal cancels fw_work and dump_work, but leaves read_data_work
pending or running. The latter accesses the firmware and the device-managed
context and transfer buffer, which are released during removal.

Cancel read_data_work after fw_work, which can schedule it, and before
releasing the firmware. The MHI core suspends and resets the channels
before invoking the driver's remove callback.

This issue was identified during our ongoing static-analysis research
while reviewing kernel code. The same omission was also reported by the
Sashiko bot while reviewing the Sahara relocation series.

Fixes: 7fb19ea1ec6a ("accel/qaic: Support the new READ_DATA implementation")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Validated with static source review, apply checks and strict checkpatch.
No build or runtime testing was performed.

 drivers/accel/qaic/sahara.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/accel/qaic/sahara.c b/drivers/accel/qaic/sahara.c
index c7c0b3eb4b65fb7776a6c724cb3105046cf6f7eb..6487961bbf14a1c284caf91f500968b90a064ef4 100644
--- a/drivers/accel/qaic/sahara.c
+++ b/drivers/accel/qaic/sahara.c
@@ -879,6 +879,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev)
 	struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);
 
 	cancel_work_sync(&context->fw_work);
+	cancel_work_sync(&context->read_data_work);
 	cancel_work_sync(&context->dump_work);
 	vfree(context->mem_dump);
 	sahara_release_image(context);
-- 
2.47.1

Re: [PATCH] accel/qaic: Cancel Sahara read data work on removal

[Jeff Hugo]

On 9/17/2026 1:25 PM, Myeonghun Pak wrote:
> Sahara removal cancels fw_work and dump_work, but leaves read_data_work
> pending or running. The latter accesses the firmware and the device-managed
> context and transfer buffer, which are released during removal.
> 
> Cancel read_data_work after fw_work, which can schedule it, and before
> releasing the firmware. The MHI core suspends and resets the channels
> before invoking the driver's remove callback.
> 
> This issue was identified during our ongoing static-analysis research
> while reviewing kernel code. The same omission was also reported by the
> Sashiko bot while reviewing the Sahara relocation series.
> 
> Fixes: 7fb19ea1ec6a ("accel/qaic: Support the new READ_DATA implementation")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260701105055.8D4371F00A3A@smtp.kernel.org/
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
> Validated with static source review, apply checks and strict checkpatch.
> No build or runtime testing was performed.
> 
>   drivers/accel/qaic/sahara.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/accel/qaic/sahara.c b/drivers/accel/qaic/sahara.c
> index c7c0b3eb4b65fb7776a6c724cb3105046cf6f7eb..6487961bbf14a1c284caf91f500968b90a064ef4 100644
> --- a/drivers/accel/qaic/sahara.c
> +++ b/drivers/accel/qaic/sahara.c
> @@ -879,6 +879,7 @@ static void sahara_mhi_remove(struct mhi_device *mhi_dev)
>   	struct sahara_context *context = dev_get_drvdata(&mhi_dev->dev);
>   
>   	cancel_work_sync(&context->fw_work);
> +	cancel_work_sync(&context->read_data_work);

The typical convention is that ordering of operations in remove() is 
related to the order of operations in probe().  Adding this line here is 
arbitrary where it would fit the convention better if moved one line down.

I'll fix that up when applying this.

>   	cancel_work_sync(&context->dump_work);
>   	vfree(context->mem_dump);
>   	sahara_release_image(context);

Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>