[PATCH] rapidio: tsi721: Cancel the self-rearming doorbell work on removal

[Myeonghun Pak]

tsi721_db_dpc() schedules idb_work again when another doorbell arrives
while it is restoring the queue interrupt. flush_work() waits for the
instance that was queued at the start of the flush, but does not prevent
that instance from queuing a successor. Removal can therefore free the
doorbell buffer and device state with another instance still pending.

Use cancel_work_sync() after freeing the IRQs. At that point the external
producer has stopped, and synchronous cancellation also handles a worker
that rearms itself. The non-rearming port-write work can still be flushed.

This issue was found by static analysis.

Fixes: 3670e7e12e58 ("rapidio/tsi721: fix inbound doorbell interrupt handling")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Compile-tested with GCC, W=1 (arm). No runtime testing.

 drivers/rapidio/devices/tsi721.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/rapidio/devices/tsi721.c b/drivers/rapidio/devices/tsi721.c
index 71b87bf..2bae63e 100644
--- a/drivers/rapidio/devices/tsi721.c
+++ b/drivers/rapidio/devices/tsi721.c
@@ -2978,7 +2978,7 @@ static void tsi721_remove(struct pci_dev *pdev)
 
 	tsi721_disable_ints(priv);
 	tsi721_free_irq(priv);
-	flush_work(&priv->idb_work);
+	cancel_work_sync(&priv->idb_work);
 	flush_work(&priv->pw_work);
 	rio_unregister_mport(&priv->mport);