[PATCH] ublk: pin module while release work is pending

[PATCH] ublk: pin module while release work is pending

[sonotri]

ublk_ch_release() takes a device reference and queues exit_work.  The VFS
module reference held through the file operations is dropped after
->release() returns.  A queued work item does not acquire its own module
reference for the callback.

Consequently, normal module removal can start while exit_work is pending or
executing.  In addition to the worker callback itself, the final device put
can invoke ublk_cdev_rel(), which is also module code.

Take a module reference while ->release() is still covered by the file
operations reference and drop it only after the worker has completed its
final device put.  A rearming worker retains the same reference.

Merely canceling exit_work during module exit is insufficient.  The worker
is the terminal path for the device reference taken by ublk_ch_release(),
so its cancellation would strand that reference and skip the associated
cleanup.

Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
Cc: stable@vger.kernel.org
Signed-off-by: sonotri <sono7ri@gmail.com>
---
 drivers/block/ublk_drv.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 66eb55e71..71556c34a 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -2613,6 +2613,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
 
 	/* put the reference grabbed in ublk_ch_release() */
 	ublk_put_device(ub);
+	module_put(THIS_MODULE);
 }
 
 static int ublk_ch_release(struct inode *inode, struct file *filp)
@@ -2625,6 +2626,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
 	 */
 	ublk_get_device(ub);
 
+	/* Keep the worker's callback and final device release code resident. */
+	__module_get(THIS_MODULE);
 	INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
 	schedule_delayed_work(&ub->exit_work, 0);
 	return 0;
-- 
2.34.1

Re: [PATCH] ublk: pin module while release work is pending

[Ming Lei]

On Thu, Oct 15, 2026 at 7:07 AM sonotri <sono7ri@gmail.com> wrote:
>
> ublk_ch_release() takes a device reference and queues exit_work.  The VFS
> module reference held through the file operations is dropped after
> ->release() returns.  A queued work item does not acquire its own module
> reference for the callback.
>
> Consequently, normal module removal can start while exit_work is pending or
> executing.  In addition to the worker callback itself, the final device put
> can invoke ublk_cdev_rel(), which is also module code.
>
> Take a module reference while ->release() is still covered by the file
> operations reference and drop it only after the worker has completed its
> final device put.  A rearming worker retains the same reference.
>
> Merely canceling exit_work during module exit is insufficient.  The worker
> is the terminal path for the device reference taken by ublk_ch_release(),
> so its cancellation would strand that reference and skip the associated
> cleanup.
>
> Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
> Cc: stable@vger.kernel.org
> Signed-off-by: sonotri <sono7ri@gmail.com>
> ---
>  drivers/block/ublk_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 66eb55e71..71556c34a 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2613,6 +2613,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
>
>         /* put the reference grabbed in ublk_ch_release() */
>         ublk_put_device(ub);
> +       module_put(THIS_MODULE);
>  }
>
>  static int ublk_ch_release(struct inode *inode, struct file *filp)
> @@ -2625,6 +2626,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
>          */
>         ublk_get_device(ub);
>
> +       /* Keep the worker's callback and final device release code resident. */
> +       __module_get(THIS_MODULE);
>         INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
>         schedule_delayed_work(&ub->exit_work, 0);
>         return 0;

Reviewed-by: Ming Lei <tom.leiming@gmail.com>

Thanks,
Ming Lei