Re: [PATCH] ublk: pin module while release work is pending

[Ming Lei]

On Thu, Oct 15, 2026 at 7:07 AM sonotri <sono7ri@xxxxxxxxx> wrote:
>
> ublk_ch_release() takes a device reference and queues exit_work.  The VFS
> module reference held through the file operations is dropped after
> ->release() returns.  A queued work item does not acquire its own module
> reference for the callback.
>
> Consequently, normal module removal can start while exit_work is pending or
> executing.  In addition to the worker callback itself, the final device put
> can invoke ublk_cdev_rel(), which is also module code.
>
> Take a module reference while ->release() is still covered by the file
> operations reference and drop it only after the worker has completed its
> final device put.  A rearming worker retains the same reference.
>
> Merely canceling exit_work during module exit is insufficient.  The worker
> is the terminal path for the device reference taken by ublk_ch_release(),
> so its cancellation would strand that reference and skip the associated
> cleanup.
>
> Fixes: c5c5eb24ed61 ("ublk: avoid ublk_io_release() called after ublk char dev is closed")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: sonotri <sono7ri@xxxxxxxxx>
> ---
>  drivers/block/ublk_drv.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index 66eb55e71..71556c34a 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -2613,6 +2613,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work)
>
>         /* put the reference grabbed in ublk_ch_release() */
>         ublk_put_device(ub);
> +       module_put(THIS_MODULE);
>  }
>
>  static int ublk_ch_release(struct inode *inode, struct file *filp)
> @@ -2625,6 +2626,8 @@ static int ublk_ch_release(struct inode *inode, struct file *filp)
>          */
>         ublk_get_device(ub);
>
> +       /* Keep the worker's callback and final device release code resident. */
> +       __module_get(THIS_MODULE);
>         INIT_DELAYED_WORK(&ub->exit_work, ublk_ch_release_work_fn);
>         schedule_delayed_work(&ub->exit_work, 0);
>         return 0;

Reviewed-by: Ming Lei <tom.leiming@xxxxxxxxx>

Thanks,
Ming Lei