On 8/15/25 3:01 AM, Fan Gong wrote:
> +static void remove_eq(struct hinic3_eq *eq)
> +{
> + hinic3_set_msix_state(eq->hwdev, eq->msix_entry_idx,
> + HINIC3_MSIX_DISABLE);
> + free_irq(eq->irq_id, eq);
> + /* Indirect access should set q_id first */
> + hinic3_hwif_write_reg(eq->hwdev->hwif,
> + HINIC3_EQ_INDIR_IDX_ADDR(eq->type),
> + eq->q_id);
> +
> + cancel_work_sync(&eq->aeq_work);
The above should be 'disable_work_sync()' to avoid the work being
re-scheduled by the flushed handler and later UaF.
/P
