Thread (3 messages) 3 messages, 3 authors, 2026-02-26

Re: [PATCH net] net: mana: Fix double destroy_workqueue on service rescan PCI path

From: patchwork-bot+netdevbpf@kernel.org
Date: 2026-02-26 03:20:09
Also in: linux-hyperv, linux-rdma, lkml

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski [off-list ref]:

On Tue, 24 Feb 2026 04:38:36 -0800 you wrote:
While testing corner cases in the driver, a use-after-free crash
was found on the service rescan PCI path.

When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup()
destroys gc->service_wq. If the subsequent mana_gd_resume() fails
with -ETIMEDOUT or -EPROTO, the code falls through to
mana_serv_rescan() which triggers pci_stop_and_remove_bus_device().
This invokes the PCI .remove callback (mana_gd_remove), which calls
mana_gd_cleanup() a second time, attempting to destroy the already-
freed workqueue. Fix this by NULL-checking gc->service_wq in
mana_gd_cleanup() and setting it to NULL after destruction.

[...]
Here is the summary with links:
  - [net] net: mana: Fix double destroy_workqueue on service rescan PCI path
    https://git.kernel.org/netdev/net/c/f975a0955276

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help