From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC1FC9446 for ; Sun, 13 Aug 2023 21:47:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7134CC433C7; Sun, 13 Aug 2023 21:47:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1691963265; bh=rbw8fl77dRKZDM7hNG64KWXaRzhiZt/JGSs6xgpc0RI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HjHj/Cmy6EWHv8R8JtBnsJIJ4vfL/DqELaKCOB2ZTFFslbPWytbwDf1I7H6n5eOEI n7Njogt4kYKQXNfNroKN/TybWmBy73F1w+3Xl+jrX2Xqhq6GqaW4zyvOCGKQvZ6QOL QyyzhBvwJj8eRlnSq12c4oV1ilVL+2e3/htRxDRY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Douglas Miller , Dennis Dalessandro , Leon Romanovsky Subject: [PATCH 5.4 23/39] IB/hfi1: Fix possible panic during hotplug remove Date: Sun, 13 Aug 2023 23:20:14 +0200 Message-ID: <20230813211705.611922278@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230813211704.796906808@linuxfoundation.org> References: <20230813211704.796906808@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Douglas Miller commit 4fdfaef71fced490835145631a795497646f4555 upstream. During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Signed-off-by: Douglas Miller Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/169099756100.3927190.15284930454106475280.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/hw/hfi1/chip.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/infiniband/hw/hfi1/chip.c +++ b/drivers/infiniband/hw/hfi1/chip.c @@ -12191,6 +12191,7 @@ static void free_cntrs(struct hfi1_devda if (dd->synth_stats_timer.function) del_timer_sync(&dd->synth_stats_timer); + cancel_work_sync(&dd->update_cntr_work); ppd = (struct hfi1_pportdata *)(dd + 1); for (i = 0; i < dd->num_pports; i++, ppd++) { kfree(ppd->cntrs);