The 9P remove callback frees virtqueues while the device can still access them, then resets the device. Outstanding requests can therefore race with freeing the ring memory.
Use the common reset helper, which waits for the device to stop before releasing its queues. Signed-off-by: Bin Meng <[email protected]> --- drivers/virtio/virtio_9p.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/virtio/virtio_9p.c b/drivers/virtio/virtio_9p.c index fb2eb0c7223..d0fb39a1de5 100644 --- a/drivers/virtio/virtio_9p.c +++ b/drivers/virtio/virtio_9p.c @@ -102,19 +102,13 @@ static int virtio_9p_probe(struct udevice *dev) return 0; } -static int virtio_9p_remove(struct udevice *dev) -{ - virtio_del_vqs(dev); - return virtio_reset(dev); -} - U_BOOT_DRIVER(virtio_9p) = { .name = VIRTIO_9P_DRV_NAME, .id = UCLASS_9P, .ops = &virtio_9p_ops, .bind = virtio_9p_bind, .probe = virtio_9p_probe, - .remove = virtio_9p_remove, + .remove = virtio_reset, .priv_auto = sizeof(struct virtio_9p_priv), .flags = DM_FLAG_ACTIVE_DMA, }; -- 2.53.0
