Re: [PATCH v2] bus: mhi: ep: cancel reset work during controller teardown

[Jeff Hugo <jeff.hugo@oss.qualcomm.com>]

On 10/21/2026 5:04 AM, Jiale Yao wrote:
> The doorbell IRQ schedules reset_work on the system workqueue when the
> host requests an MHI reset. The controller teardown only drains the
> private MHI workqueue before releasing the controller state, so
> reset_work can still run after that state has been freed.
> 
> Cancel reset_work before destroying the private workqueue and releasing
> the controller resources. The caller is required to power down the
> controller first, so the IRQ can no longer queue the work at this point.
> 
> The issue was found by static analysis. The fix was tested with an
> out-of-tree module that registers a real mhi_ep_cntrl backed by a
> software IRQ and a fake register file. The module drives mhi_ep_irq()
> and mhi_ep_unregister_controller(), and delays the reset worker until
> after the controller state has been freed. Without this fix, KASAN
> reports a slab-use-after-free in mhi_ep_ring_init() from
> mhi_ep_reset_worker. With this fix applied, controller teardown waits
> for the reset worker and the KASAN report is no longer reproduced.
> 
> Fixes: 7a97b6b47353 ("bus: mhi: ep: Add support for handling MHI_RESET")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiale Yao <yaojiale02@163.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>