Patch "ionic: no double destroy workqueue" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ionic: no double destroy workqueue

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ionic-no-double-destroy-workqueue.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ef76e96a5e8b213bcf8941c179f6952165aab655
Author: Shannon Nelson <shannon.nelson@xxxxxxx>
Date:   Thu Dec 12 13:31:56 2024 -0800

    ionic: no double destroy workqueue
    
    [ Upstream commit 746e6ae2e202b062b9deee7bd86d94937997ecd7 ]
    
    There are some FW error handling paths that can cause us to
    try to destroy the workqueue more than once, so let's be sure
    we're checking for that.
    
    The case where this popped up was in an AER event where the
    handlers got called in such a way that ionic_reset_prepare()
    and thus ionic_dev_teardown() got called twice in a row.
    The second time through the workqueue was already destroyed,
    and destroy_workqueue() choked on the bad wq pointer.
    
    We didn't hit this in AER handler testing before because at
    that time we weren't using a private workqueue.  Later we
    replaced the use of the system workqueue with our own private
    workqueue but hadn't rerun the AER handler testing since then.
    
    Fixes: 9e25450da700 ("ionic: add private workqueue per-device")
    Signed-off-by: Shannon Nelson <shannon.nelson@xxxxxxx>
    Reviewed-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Link: https://patch.msgid.link/20241212213157.12212-3-shannon.nelson@xxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_dev.c b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
index 9e42d599840d..57edcde9e6f8 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_dev.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_dev.c
@@ -277,7 +277,10 @@ void ionic_dev_teardown(struct ionic *ionic)
 	idev->phy_cmb_pages = 0;
 	idev->cmb_npages = 0;
 
-	destroy_workqueue(ionic->wq);
+	if (ionic->wq) {
+		destroy_workqueue(ionic->wq);
+		ionic->wq = NULL;
+	}
 	mutex_destroy(&idev->cmb_inuse_lock);
 }