scsi: ufs: core: Cancel RTC work during ufshcd_remove()

JIRA: https://issues.redhat.com/browse/RHEL-79078

commit 1695c43
Author: Manivannan Sadhasivam <mani@kernel.org>
Date:   Mon Nov 11 23:18:30 2024 +0530

    scsi: ufs: core: Cancel RTC work during ufshcd_remove()

    Currently, RTC work is only cancelled during __ufshcd_wl_suspend(). When
    ufshcd is removed in ufshcd_remove(), RTC work is not cancelled. Due to
    this, any further trigger of the RTC work after ufshcd_remove() would
    result in a NULL pointer dereference as below:

    Unable to handle kernel NULL pointer dereference at virtual address 00000000000002a4
    Workqueue: events ufshcd_rtc_work
    Call trace:
     _raw_spin_lock_irqsave+0x34/0x8c
     pm_runtime_get_if_active+0x24/0xb4
     ufshcd_rtc_work+0x124/0x19c
     process_scheduled_works+0x18c/0x2d8
     worker_thread+0x144/0x280
     kthread+0x11c/0x128
     ret_from_fork+0x10/0x20

    Since RTC work accesses the ufshcd internal structures, it should be cancelled
    when ufshcd is removed. So do that in ufshcd_remove(), as per the order in
    ufshcd_init().

    Cc: stable@vger.kernel.org # 6.8
    Fixes: 6bf999e ("scsi: ufs: core: Add UFS RTC support")
    Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Link: https://lore.kernel.org/r/20241111-ufs_bug_fix-v1-1-45ad8b62f02e@linaro.org
    Reviewed-by: Peter Wang <peter.wang@mediatek.com>
    Reviewed-by: Bean Huo <beanhuo@micron.com>
    Reviewed-by: Bart Van Assche <bvanassche@acm.org>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

Signed-off-by: Radu Rendec <rrendec@redhat.com>

Author: rrendec

drivers/ufs/core/ufshcd.c

@@ -10233,6 +10233,7 @@ void ufshcd_remove(struct ufs_hba *hba)
 	ufs_hwmon_remove(hba);
 	ufs_bsg_remove(hba);
 	ufs_sysfs_remove_nodes(hba->dev);
+	cancel_delayed_work_sync(&hba->ufs_rtc_update_work);
 	blk_mq_destroy_queue(hba->tmf_queue);
 	blk_put_queue(hba->tmf_queue);
 	blk_mq_free_tag_set(&hba->tmf_tag_set);