Patch "cxl/mem: Fix shutdown order" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    cxl/mem: Fix shutdown order

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     cxl-mem-fix-shutdown-order.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7c2992a8f343006faa1b2ebb15a4118a45cea10a
Author: Dan Williams <dan.j.williams@xxxxxxxxx>
Date:   Thu Sep 28 18:02:07 2023 -0700

    cxl/mem: Fix shutdown order
    
    [ Upstream commit 88d3917f82ed4215a2154432c26de1480a61b209 ]
    
    Ira reports that removing cxl_mock_mem causes a crash with the following
    trace:
    
     BUG: kernel NULL pointer dereference, address: 0000000000000044
     [..]
     RIP: 0010:cxl_region_decode_reset+0x7f/0x180 [cxl_core]
     [..]
     Call Trace:
      <TASK>
      cxl_region_detach+0xe8/0x210 [cxl_core]
      cxl_decoder_kill_region+0x27/0x40 [cxl_core]
      cxld_unregister+0x29/0x40 [cxl_core]
      devres_release_all+0xb8/0x110
      device_unbind_cleanup+0xe/0x70
      device_release_driver_internal+0x1d2/0x210
      bus_remove_device+0xd7/0x150
      device_del+0x155/0x3e0
      device_unregister+0x13/0x60
      devm_release_action+0x4d/0x90
      ? __pfx_unregister_port+0x10/0x10 [cxl_core]
      delete_endpoint+0x121/0x130 [cxl_core]
      devres_release_all+0xb8/0x110
      device_unbind_cleanup+0xe/0x70
      device_release_driver_internal+0x1d2/0x210
      bus_remove_device+0xd7/0x150
      device_del+0x155/0x3e0
      ? lock_release+0x142/0x290
      cdev_device_del+0x15/0x50
      cxl_memdev_unregister+0x54/0x70 [cxl_core]
    
    This crash is due to the clearing out the cxl_memdev's driver context
    (@cxlds) before the subsystem is done with it. This is ultimately due to
    the region(s), that this memdev is a member, being torn down and expecting
    to be able to de-reference @cxlds, like here:
    
    static int cxl_region_decode_reset(struct cxl_region *cxlr, int count)
    ...
                    if (cxlds->rcd)
                            goto endpoint_reset;
    ...
    
    Fix it by keeping the driver context valid until memdev-device
    unregistration, and subsequently the entire stack of related
    dependencies, unwinds.
    
    Fixes: 9cc238c7a526 ("cxl/pci: Introduce cdevm_file_operations")
    Reported-by: Ira Weiny <ira.weiny@xxxxxxxxx>
    Reviewed-by: Davidlohr Bueso <dave@xxxxxxxxxxxx>
    Reviewed-by: Dave Jiang <dave.jiang@xxxxxxxxx>
    Reviewed-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
    Reviewed-by: Ira Weiny <ira.weiny@xxxxxxxxx>
    Tested-by: Ira Weiny <ira.weiny@xxxxxxxxx>
    Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 20ce488a77540..03cf99cce7047 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -214,8 +214,8 @@ static void cxl_memdev_unregister(void *_cxlmd)
 	struct cxl_memdev *cxlmd = _cxlmd;
 	struct device *dev = &cxlmd->dev;
 
-	cxl_memdev_shutdown(dev);
 	cdev_device_del(&cxlmd->cdev, dev);
+	cxl_memdev_shutdown(dev);
 	put_device(dev);
 }