Re: [PATCH] NTB: ntb_msi_test: Cancel setup work on remove

[Logan Gunthorpe <logang@deltatee.com>]

On 2026-09-09 08:55, Fan Wu wrote:
> The MSI test client queues setup_work from the link event callback
> ntb_msit_link_event(), which the NTB core dispatches whenever the link
> comes up. The work handler ntb_msit_setup_work() recovers the client
> context with container_of() and programs memory windows, scratchpad
> registers and MSI interrupts through it.
> 
> ntb_msit_remove() never cancels the work. ntb_clear_ctx() stops new
> link event callbacks from being dispatched, but it does not drain a
> setup_work that was already queued. After the remove callback returns,
> the NTB device's devm eventually releases the context, and a
> still-pending setup work can then run and dereference freed memory.
> 
> Quiesce the callbacks and drain the work before tearing down the
> resources the work programs. Cancel the work after ntb_clear_ctx(),
> which guarantees no new instance can be queued: link events are
> dispatched under the same ctx_lock that ntb_clear_ctx() holds. Do this
> before ntb_msi_clear_mws(), so a late setup work cannot re-program
> memory windows that remove() has already cleared.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a6bed7a54165 ("NTB: Introduce NTB MSI Test Client")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

This makes sense to me, thanks!

Reviewed-by: Logan Gunthorpe <logang@deltatee.com>