Re: [PATCH] HSI: ssi_protocol: don't cancel_work_sync() under ssi->lock in ssip_reset

[Andy Shevchenko]

On Wed, Nov 11, 2026 at 06:04:47PM +0900, Hyunjung Ko wrote:
> ssip_reset() calls cancel_work_sync(&ssi->work) inside the
> spin_lock_bh(&ssi->lock) section. cancel_work_sync() calls might_sleep(),
> so running it under the bh spinlock triggers "BUG: sleeping function called
> from invalid context". In addition, the cancelled work ssip_xmit_work() ->
> ssip_xmit() takes ssi->lock itself, so waiting for it while holding the
> lock can deadlock.
> 
> Move cancel_work_sync() out of the locked section. It still runs in
> ssip_reset() before teardown, so the use-after-free fix is preserved.

But is it okay to run before timers are gone?

...

>  	spin_unlock_bh(&ssi->lock);
>  	if (test_and_clear_bit(SSIP_WAKETEST_FLAG, &ssi->flags))
>  		ssi_waketest(cl, 0); /* FIXME: To be removed */
> +	cancel_work_sync(&ssi->work);
>  	spin_lock_bh(&ssi->lock);
>  	timer_delete(&ssi->rx_wd);
>  	timer_delete(&ssi->tx_wd);
>  	timer_delete(&ssi->keep_alive);
> -	cancel_work_sync(&ssi->work);

-- 
With Best Regards,
Andy Shevchenko