[PATCH] memstick: rtsx_usb_ms: disable poll_card work on removal

[Myeonghun Pak]

rtsx_usb_ms_drv_remove() sets host->eject and cancels poll_card, but a
concurrent rtsx_usb_ms_set_param() that already read eject as false
can queue the work after the cancel. Its callers, memstick_check() and
ms_block error recovery, are stopped only by the later
memstick_remove_host(). The delayed work can therefore run after
memstick_free_host() frees the host.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: 4676741a3464 ("memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove")
Cc: stable@xxxxxxxxxxxxxxx # v6.10+
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

---

diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c
index d5b3a96fc609..85a681e4664b 100644
--- a/drivers/memstick/host/rtsx_usb_ms.c
+++ b/drivers/memstick/host/rtsx_usb_ms.c
@@ -820,7 +820,7 @@ static void rtsx_usb_ms_drv_remove(struct platform_device *pdev)
 	host->eject = true;
 	msh->removing = true;
 	flush_work(&host->handle_req);
-	cancel_delayed_work_sync(&host->poll_card);
+	disable_delayed_work_sync(&host->poll_card);
 
 	/* Balance possible unbalanced usage count
 	 * e.g. unconditional module removal

base-commit: 630059a5a632377b9b7b487baccde92b7ae1dd47
-- 
2.43.0