From: Douglas Miller Date: Wed, 2 Aug 2023 17:32:41 +0000 (-0400) Subject: IB/hfi1: Fix possible panic during hotplug remove X-Git-Tag: v4.14.323~9 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5e72f33ddfdb69cb21c1b59d31bbd3498d31b14a;p=thirdparty%2Fkernel%2Fstable.git IB/hfi1: Fix possible panic during hotplug remove commit 4fdfaef71fced490835145631a795497646f4555 upstream. During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory. Fixes: 7724105686e7 ("IB/hfi1: add driver files") Signed-off-by: Douglas Miller Signed-off-by: Dennis Dalessandro Link: https://lore.kernel.org/r/169099756100.3927190.15284930454106475280.stgit@awfm-02.cornelisnetworks.com Signed-off-by: Leon Romanovsky Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c index cb5785dda524e..ac804c3abd952 100644 --- a/drivers/infiniband/hw/hfi1/chip.c +++ b/drivers/infiniband/hw/hfi1/chip.c @@ -12141,6 +12141,7 @@ static void free_cntrs(struct hfi1_devdata *dd) if (dd->synth_stats_timer.data) del_timer_sync(&dd->synth_stats_timer); + cancel_work_sync(&dd->update_cntr_work); dd->synth_stats_timer.data = 0; ppd = (struct hfi1_pportdata *)(dd + 1); for (i = 0; i < dd->num_pports; i++, ppd++) {