[PATCH] s390/tape: cancel delayed work before freeing device

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

tape_put_device() frees the tape_device on the final reference drop
without cancelling the pending delayed work tape_dnr. If
tape_delayed_next_request() is still scheduled or running when the
struct is freed, the work function accesses freed memory via
container_of().

Add cancel_delayed_work_sync() before kfree() to ensure the work is
fully completed before the struct is freed.

Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 drivers/s390/char/tape_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index bd8e3deb11993..e3aacfab2cc7a 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -532,6 +532,7 @@ tape_put_device(struct tape_device *device)
 	DBF_EVENT(4, "tape_put_device(%p) -> %i\n", device, count);
 	BUG_ON(count < 0);
 	if (count == 0) {
+		cancel_delayed_work_sync(&device->tape_dnr);
 		kfree(device->modeset_byte);
 		kfree(device);
 	}
-- 
2.47.3