Re: [PATCH net] net: mana: Fix double destroy_workqueue on service rescan PCI path
From: patchwork-bot+netdevbpf@kernel.org
Date: 2026-02-26 03:20:09
Also in:
linux-hyperv, linux-rdma, lkml
From: patchwork-bot+netdevbpf@kernel.org
Date: 2026-02-26 03:20:09
Also in:
linux-hyperv, linux-rdma, lkml
Hello: This patch was applied to netdev/net.git (main) by Jakub Kicinski [off-list ref]: On Tue, 24 Feb 2026 04:38:36 -0800 you wrote:
While testing corner cases in the driver, a use-after-free crash was found on the service rescan PCI path. When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() destroys gc->service_wq. If the subsequent mana_gd_resume() fails with -ETIMEDOUT or -EPROTO, the code falls through to mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). This invokes the PCI .remove callback (mana_gd_remove), which calls mana_gd_cleanup() a second time, attempting to destroy the already- freed workqueue. Fix this by NULL-checking gc->service_wq in mana_gd_cleanup() and setting it to NULL after destruction. [...]
Here is the summary with links:
- [net] net: mana: Fix double destroy_workqueue on service rescan PCI path
https://git.kernel.org/netdev/net/c/f975a0955276
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html