s390/vfio_ccw: Cancel existing workqueues

The initialization of the io_work and crw_work workqueues begs the
question of whether they should be un-initialized. Add the corresponding
cleanup tags in _release_dev to ensure work isn't dispatched after
the private struct is free'd.

Suggested-by: Matthew Rosato <mjrosato@linux.ibm.com>
Fixes: e5f84dbaea59 ("vfio: ccw: return I/O results asynchronously")
Fixes: 3f02cb2fd9d2 ("vfio-ccw: Wire up the CRW irq and CRW region")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>

diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c
index 032a1cdf4df7072b821672c65f6566cfdeb46564..d361d1fde3a0d319ab4529c9f2e807d3e41b58ae 100644 (file)
--- a/drivers/s390/cio/vfio_ccw_ops.c
+++ b/drivers/s390/cio/vfio_ccw_ops.c
@@ -131,6 +131,13 @@ static void vfio_ccw_mdev_release_dev(struct vfio_device *vdev)
                container_of(vdev, struct vfio_ccw_private, vdev);
        struct vfio_ccw_crw *crw, *temp;
 
+       /*
+        * Ensure these work items are fully drained, so none can
+        * fire after being released.
+        */
+       cancel_work_sync(&private->io_work);
+       cancel_work_sync(&private->crw_work);
+
        list_for_each_entry_safe(crw, temp, &private->crw, next) {
                list_del(&crw->next);
                kfree(crw);
@@ -202,6 +209,14 @@ static void vfio_ccw_mdev_close_device(struct vfio_device *vdev)
                container_of(vdev, struct vfio_ccw_private, vdev);
 
        vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_CLOSE);
+
+       /*
+        * Ensure these work items are drained, in the event the
+        * device is re-opened instead of released.
+        */
+       cancel_work_sync(&private->io_work);
+       cancel_work_sync(&private->crw_work);
+
        vfio_ccw_unregister_dev_regions(private);
 }