7.3-stable review patch. If anyone has any objections, please let me know. ------------------ From: sonotri [ Upstream commit afc9cde716b29ce814798d649a95f9128ba42b43 ] ublk_ch_release() takes a device reference and queues exit_work. The VFS module reference held through the file operations is dropped after ->release() returns. A queued work item does not acquire its own module reference for the callback. Consequently, normal module removal can start while exit_work is pending or executing. In addition to the worker callback itself, the final device put can invoke ublk_cdev_rel(), which is also module code. Take a module reference while ->release() is still covered by the file operations reference and drop it only after the worker has completed its final device put. A rearming worker retains the same reference. Merely canceling exit_work during module exit is insufficient. The worker is the terminal path for the device reference taken by ublk_ch_release(), so its cancellation would strand that reference and skip the associated cleanup. Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed") Cc: stable@vger.kernel.org Signed-off-by: sonotri Reviewed-by: Ming Lei Link: https://patch.msgid.link/20261015120654.241354-1-sono7ri@gmail.com Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- drivers/block/ublk_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index a49bd30154e01..1ef01ce18f4f0 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -2637,6 +2637,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work) /* put the reference grabbed in ublk_ch_release() */ ublk_put_device(ub); + module_put(THIS_MODULE); } static int ublk_ch_release(struct inode *inode, struct file *filp) @@ -2652,6 +2653,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp) */ ublk_get_device(ub); + /* Keep the worker's callback and final device release code resident. */ + __module_get(THIS_MODULE); INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn); schedule_delayed_work(&ub->exit_work, 0); return 0; -- 2.53.0