From: Tristan Madani ppa_detach() frees the ppa_struct without cancelling the pending delayed work ppa_tq. If ppa_interrupt() is still scheduled or running when the struct is freed, the work function accesses freed memory via container_of(). Add cancel_delayed_work_sync() before teardown, matching the pattern in the sibling imm driver. Fixes: c4028958b6eca ("WorkStruct: make allyesconfig") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- drivers/scsi/ppa.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/ppa.c b/drivers/scsi/ppa.c index 8a4e910d5758f..7f4b2a4157725 100644 --- a/drivers/scsi/ppa.c +++ b/drivers/scsi/ppa.c @@ -1136,6 +1136,7 @@ static void ppa_detach(struct parport *pb) ppa_struct *dev; list_for_each_entry(dev, &ppa_hosts, list) { if (dev->dev->port == pb) { + cancel_delayed_work_sync(&dev->ppa_tq); list_del_init(&dev->list); scsi_remove_host(dev->host); scsi_host_put(dev->host); -- 2.47.3