[PATCH] soc: fsl: dpio: fix use-after-free of the net DIM work

[Fan Wu]

dpaa2_io_create() registers a work handler for the receive dynamic
interrupt moderation (INIT_WORK(&obj->rx_dim.work, dpaa2_io_dim_work)).
When adaptive RX coalescing is enabled, the receive path calls
dpaa2_io_update_net_dim(), and net_dim() schedules rx_dim.work on the
system workqueue whenever the moderation profile changes. The worker
recovers the owning dpaa2_io with container_of() and programs the
interrupt coalescing through d->swp.

dpaa2_io_down() removes the object from the service list and frees it
without waiting for this work, so a moderation update that is still
pending or running when the DPIO device is removed dereferences freed
memory.

Fix this by cancelling rx_dim.work in dpaa2_io_down() before the object
is freed, so a pending or running moderation update finishes while the
dpaa2_io it dereferences is still alive.

This issue was found by an in-house static analysis tool.

Fixes: 69651bd8d303 ("soc: fsl: dpio: add Net DIM integration")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@xxxxxxxxxx>
Signed-off-by: Song Li <songl@xxxxxxxxxx>
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/soc/fsl/dpio/dpio-service.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c
index 317ca50b0c2b..1ea185f8a4bd 100644
--- a/drivers/soc/fsl/dpio/dpio-service.c
+++ b/drivers/soc/fsl/dpio/dpio-service.c
@@ -205,6 +205,8 @@ struct dpaa2_io *dpaa2_io_create(const struct dpaa2_io_desc *desc,
  */
 void dpaa2_io_down(struct dpaa2_io *d)
 {
+	cancel_work_sync(&d->rx_dim.work);
+
 	spin_lock(&dpio_list_lock);
 	dpio_by_cpu[d->dpio_desc.cpu] = NULL;
 	list_del(&d->node);
-- 
2.34.1