net/ncsi: Disable the ncsi work before freeing the associated structure

Eddie James · gregkh · commit dd41dab62f32 · 2024-10-10T12:03:01.000+02:00
[ Upstream commit a0ffa68 ] The work function can run after the ncsi device is freed, resulting in use-after-free bugs or kernel panic. Fixes: 2d283bd ("net/ncsi: Resource management") Signed-off-by: Eddie James <eajames@linux.ibm.com> Link: https://patch.msgid.link/20240925155523.1017097-1-eajames@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
@@ -1954,6 +1954,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)
 	list_del_rcu(&ndp->node);
 	spin_unlock_irqrestore(&ncsi_dev_lock, flags);
 
+	disable_work_sync(&ndp->work);
+
 	kfree(ndp);
 }
 EXPORT_SYMBOL_GPL(ncsi_unregister_dev);

Original file line number	Diff line number	Diff line change
`@@ -1954,6 +1954,8 @@ void ncsi_unregister_dev(struct ncsi_dev *nd)`
`1954`	`1954`	`list_del_rcu(&ndp->node);`
`1955`	`1955`	`spin_unlock_irqrestore(&ncsi_dev_lock, flags);`
`1956`	`1956`
	`1957`	`+ disable_work_sync(&ndp->work);`
	`1958`	`+`
`1957`	`1959`	`kfree(ndp);`
`1958`	`1960`	`}`
`1959`	`1961`	`EXPORT_SYMBOL_GPL(ncsi_unregister_dev);`