The MSI test client queues setup_work from the link event callback
ntb_msit_link_event(), which the NTB core dispatches whenever the link
comes up. The work handler ntb_msit_setup_work() recovers the client
context with container_of() and programs memory windows, scratchpad
registers and MSI interrupts through it.

ntb_msit_remove() never cancels the work. ntb_clear_ctx() stops new
link event callbacks from being dispatched, but it does not drain a
setup_work that was already queued. After the remove callback returns,
the NTB device's devm eventually releases the context, and a
still-pending setup work can then run and dereference freed memory.

Quiesce the callbacks and drain the work before tearing down the
resources the work programs. Cancel the work after ntb_clear_ctx(),
which guarantees no new instance can be queued: link events are
dispatched under the same ctx_lock that ntb_clear_ctx() holds. Do this
before ntb_msi_clear_mws(), so a late setup work cannot re-program
memory windows that remove() has already cleared.

This issue was found by an in-house static analysis tool.

Fixes: a6bed7a54165 ("NTB: Introduce NTB MSI Test Client")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/ntb/test/ntb_msi_test.c | 3 +++
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/ntb/test/ntb_msi_test.c b/drivers/ntb/test/ntb_msi_test.c
index 4e18e08..290c2b3 100644
--- a/drivers/ntb/test/ntb_msi_test.c
+++ b/drivers/ntb/test/ntb_msi_test.c
@@ -391,13 +391,15 @@ static void ntb_msit_remove(struct ntb_client *client, struct ntb_dev *ntb)
 	int i;
 
 	ntb_link_disable(ntb);
+	ntb_clear_ctx(ntb);
+	cancel_work_sync(&nm->setup_work);
+
 	ntb_db_set_mask(ntb, ntb_db_valid_mask(ntb));
 	ntb_msi_clear_mws(ntb);
 
 	for (i = 0; i < ntb_peer_port_count(ntb); i++)
 		kfree(nm->peers[i].msi_desc);
 
-	ntb_clear_ctx(ntb);
 	ntb_msit_remove_dbgfs(nm);
 }

On 2026-09-09 08:55, Fan Wu wrote:
> The MSI test client queues setup_work from the link event callback
> ntb_msit_link_event(), which the NTB core dispatches whenever the link
> comes up. The work handler ntb_msit_setup_work() recovers the client
> context with container_of() and programs memory windows, scratchpad
> registers and MSI interrupts through it.
> 
> ntb_msit_remove() never cancels the work. ntb_clear_ctx() stops new
> link event callbacks from being dispatched, but it does not drain a
> setup_work that was already queued. After the remove callback returns,
> the NTB device's devm eventually releases the context, and a
> still-pending setup work can then run and dereference freed memory.
> 
> Quiesce the callbacks and drain the work before tearing down the
> resources the work programs. Cancel the work after ntb_clear_ctx(),
> which guarantees no new instance can be queued: link events are
> dispatched under the same ctx_lock that ntb_clear_ctx() holds. Do this
> before ntb_msi_clear_mws(), so a late setup work cannot re-program
> memory windows that remove() has already cleared.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: a6bed7a54165 ("NTB: Introduce NTB MSI Test Client")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

This makes sense to me, thanks!

Reviewed-by: Logan Gunthorpe <logang@deltatee.com>