[PATCH v1] scsi: qla2xxx: Cancel qpair work before freeing queues

The qpair response interrupt handler queues q_work with qpair as its
context. qla2xxx_create_qpair() frees qpair on setup failure after deleting
the response queue, but does not cancel work queued before the failure.
qla2xxx_delete_qpair() has the same ordering issue.

Mark the qpair as being deleted and cancel its work before deleting the
request and response queues and freeing qpair.

Fixes: d74595278f4a ("scsi: qla2xxx: Add multiple queue pair functionality.")
Signed-off-by: Yuho Choi <[email protected]>
---
 drivers/scsi/qla2xxx/qla_init.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index e746c9274cde..d5cd33e84720 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -10001,10 +10001,16 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos,
 	return qpair;
 
 fail_bufpool:
-	mempool_destroy(qpair->srb_mempool);
 fail_mempool:
-	qla25xx_delete_req_que(vha, qpair->req);
 fail_req:
+	qpair->delete_in_progress = 1;
+	if (qpair->srb_mempool) {
+		mempool_destroy(qpair->srb_mempool);
+		qpair->srb_mempool = NULL;
+	}
+	if (qpair->hw->wq)
+		cancel_work_sync(&qpair->q_work);
+	qla25xx_delete_req_que(vha, qpair->req);
 	qla25xx_delete_rsp_que(vha, qpair->rsp);
 fail_rsp:
 	mutex_lock(&ha->mq_lock);
@@ -10028,6 +10034,8 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair)
 	struct qla_hw_data *ha = qpair->hw;
 
 	qpair->delete_in_progress = 1;
+	if (qpair->hw->wq)
+		cancel_work_sync(&qpair->q_work);
 
 	qla_free_buf_pool(qpair);
 
-- 
2.43.0