[PATCH] misc: ocxl: cancel XSL fault work before freeing SPA

[Hongyan Xu <getshell@seu.edu.cn>]

The XSL fault interrupt takes an mm reference and queues fault_work
embedded in the SPA. free_irq() stops new interrupt handlers but does
not drain an already queued worker, allowing free_spa() to release its
container first.

Cancel the work after freeing the interrupt. When cancellation removes a
pending instance, also drop the mm reference that the worker would have
released.

Fixes: 5ef3166e8a32 ("ocxl: Driver code for 'generic' opencapi devices")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/misc/ocxl/link.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/misc/ocxl/link.c b/drivers/misc/ocxl/link.c
index 7749dcd16117..8146e98e77e7 100644
--- a/drivers/misc/ocxl/link.c
+++ b/drivers/misc/ocxl/link.c
@@ -335,6 +335,8 @@ static void release_xsl_irq(struct ocxl_link *link)
 
 	if (spa->virq) {
 		free_irq(spa->virq, link);
+		if (cancel_work_sync(&spa->xsl_fault.fault_work))
+			mmput(spa->xsl_fault.pe_data.mm);
 		irq_dispose_mapping(spa->virq);
 	}
 	kfree(spa->irq_name);
-- 
2.50.1.windows.1