PCI/pwrctrl: Cancel outstanding rescan work when unregistering

JIRA: https://issues.redhat.com/browse/RHEL-103213
CVE: CVE-2025-38137
Upstream Status: 8b926f2

commit 8b926f2
Author: Brian Norris <briannorris@google.com>
Date:   Wed Apr 9 11:53:13 2025 -0700

    PCI/pwrctrl: Cancel outstanding rescan work when unregistering

    It's possible to trigger use-after-free here by:

      (a) forcing rescan_work_func() to take a long time and
      (b) utilizing a pwrctrl driver that may be unloaded for some reason

    Cancel outstanding work to ensure it is finished before we allow our data
    structures to be cleaned up.

    [bhelgaas: tidy commit log]
    Fixes: 8f62819 ("PCI/pwrctl: Rescan bus on a separate thread")
    Signed-off-by: Brian Norris <briannorris@google.com>
    Signed-off-by: Brian Norris <briannorris@chromium.org>
    Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
    Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
    Cc: Konrad Dybcio <konradybcio@kernel.org>
    Link: https://patch.msgid.link/20250409115313.1.Ia319526ed4ef06bec3180378c9a008340cec9658@changeid

Signed-off-by: Myron Stowe <mstowe@redhat.com>

Author: Myron Stowe

drivers/pci/pwrctrl/core.c

@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(pci_pwrctrl_device_set_ready);
  */
 void pci_pwrctrl_device_unset_ready(struct pci_pwrctrl *pwrctrl)
 {
+	cancel_work_sync(&pwrctrl->work);
+
 	/*
 	 * We don't have to delete the link here. Typically, this function
 	 * is only called when the power control device is being detached. If