[PATCH v2] bus: mhi: ep: cancel reset work during controller teardown

[Jiale Yao]

The doorbell IRQ schedules reset_work on the system workqueue when the
host requests an MHI reset. The controller teardown only drains the
private MHI workqueue before releasing the controller state, so
reset_work can still run after that state has been freed.

Cancel reset_work before destroying the private workqueue and releasing
the controller resources. The caller is required to power down the
controller first, so the IRQ can no longer queue the work at this point.

The issue was found by static analysis. The fix was tested with an
out-of-tree module that registers a real mhi_ep_cntrl backed by a
software IRQ and a fake register file. The module drives mhi_ep_irq()
and mhi_ep_unregister_controller(), and delays the reset worker until
after the controller state has been freed. Without this fix, KASAN
reports a slab-use-after-free in mhi_ep_ring_init() from
mhi_ep_reset_worker. With this fix applied, controller teardown waits
for the reset worker and the KASAN report is no longer reproduced.

Fixes: 7a97b6b47353 ("bus: mhi: ep: Add support for handling MHI_RESET")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---

Changes in v2:
- Document how the issue was found and tested.
- Add Cc: stable@xxxxxxxxxxxxxxx.

 drivers/bus/mhi/ep/main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/bus/mhi/ep/main.c b/drivers/bus/mhi/ep/main.c
index db7ee6547eef..a9695e1a75ab 100644
--- a/drivers/bus/mhi/ep/main.c
+++ b/drivers/bus/mhi/ep/main.c
@@ -1596,6 +1596,7 @@ void mhi_ep_unregister_controller(struct mhi_ep_cntrl *mhi_cntrl)
 {
 	struct mhi_ep_device *mhi_dev = mhi_cntrl->mhi_dev;
 
+	cancel_work_sync(&mhi_cntrl->reset_work);
 	destroy_workqueue(mhi_cntrl->wq);
 
 	free_irq(mhi_cntrl->irq, mhi_cntrl);
-- 
2.34.1