[PATCH v2] s390/tape: cancel delayed work on device removal

[Tristan Madani <tristmd@gmail.com>]

From: Tristan Madani <tristan@talencesecurity.com>

tape_generic_remove() drops the device reference without cancelling
the pending delayed work tape_dnr. If tape_delayed_next_request() is
still scheduled or running when the struct is freed on the final
reference drop, the work function dereferences freed memory.

The cancel cannot go in tape_put_device() because that function is
called from atomic context (under get_ccwdev_lock with interrupts
disabled) and from within the work function itself, both of which
would deadlock or sleep in atomic context with cancel_delayed_work_sync().

Add cancel_delayed_work_sync() in tape_generic_remove() after
dev_set_drvdata() clears the device pointer and before dropping the
final reference. At this point the spinlock is not held and the device
is no longer reachable for new operations.

Fixes: 4111796d89b8c ("[PATCH] s390: channel tape fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
Changes in v2:
- Moved cancel from tape_put_device() to tape_generic_remove().
  tape_put_device() is called from atomic context (under spinlock with
  IRQs disabled) and from within tape_delayed_next_request() itself,
  so cancel_delayed_work_sync() there would deadlock or sleep in atomic.
  tape_generic_remove() runs in process context with no locks held.
 drivers/s390/char/tape_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index bd8e3deb11993..cb5db2cabd21a 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -662,6 +662,7 @@ tape_generic_remove(struct ccw_device *cdev)
 	if (device) {
 		sysfs_remove_group(&cdev->dev.kobj, &tape_attr_group);
 		dev_set_drvdata(&cdev->dev, NULL);
+		cancel_delayed_work_sync(&device->tape_dnr);
 		tape_put_device(device);
 	}
 }
-- 
2.47.3