ufshci: free the taskqueue on detach

ufshci_ctrlr_destruct() never freed the taskqueue. Every load and
unload cycle leaked the taskqueue and its kernel thread. A task that
was still queued could also run after the module was gone.

Free the taskqueue in destruct. Do it after the interrupt teardown
so nothing enqueues new work. A reset task that is still queued at
this point races the queue teardown. That race is older than this
change. The planned in-flight recovery rework will close it.

Sponsored by:           Samsung Electronics
Reviewed by:		imp (mentor)
Differential Revision:	https://reviews.freebsd.org/D58670

1 files changed, 9 insertions, 0 deletions

diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c
index 421aa1e28124..bb07ad5f76da 100644
--- a/sys/dev/ufshci/ufshci_ctrlr.c
+++ b/sys/dev/ufshci/ufshci_ctrlr.c
@@ -448,6 +448,15 @@ ufshci_ctrlr_destruct(struct ufshci_controller *ctrlr, device_t dev)
 		bus_release_resource(ctrlr->dev, SYS_RES_IRQ,
 		    rman_get_rid(ctrlr->res), ctrlr->res);
 
+	/*
+	 * The interrupt and the timers are gone, so nothing enqueues new
+	 * tasks. Free the taskqueue before the SIM teardown below.
+	 */
+	if (ctrlr->taskqueue != NULL) {
+		taskqueue_free(ctrlr->taskqueue);
+		ctrlr->taskqueue = NULL;
+	}
+
 	ufshci_sim_release_wlun_periph(ctrlr);
 
 	mtx_lock(&ctrlr->sc_mtx);