The branch main has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=2d32961316248fdff54a2a9fc24ac8b712fee9b0
commit 2d32961316248fdff54a2a9fc24ac8b712fee9b0 Author: Jaeyoon Choi <[email protected]> AuthorDate: 2026-08-10 01:52:37 +0000 Commit: Jaeyoon Choi <[email protected]> CommitDate: 2026-08-10 02:28:54 +0000 ufshci: free the taskqueue on detach ufshci_ctrlr_destruct() never freed the taskqueue. Every load and unload cycle leaked the taskqueue and its kernel thread. A task that was still queued could also run after the module was gone. Free the taskqueue in destruct. Do it after the interrupt teardown so nothing enqueues new work. A reset task that is still queued at this point races the queue teardown. That race is older than this change. The planned in-flight recovery rework will close it. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58670 --- sys/dev/ufshci/ufshci_ctrlr.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c index 421aa1e28124..bb07ad5f76da 100644 --- a/sys/dev/ufshci/ufshci_ctrlr.c +++ b/sys/dev/ufshci/ufshci_ctrlr.c @@ -448,6 +448,15 @@ ufshci_ctrlr_destruct(struct ufshci_controller *ctrlr, device_t dev) bus_release_resource(ctrlr->dev, SYS_RES_IRQ, rman_get_rid(ctrlr->res), ctrlr->res); + /* + * The interrupt and the timers are gone, so nothing enqueues new + * tasks. Free the taskqueue before the SIM teardown below. + */ + if (ctrlr->taskqueue != NULL) { + taskqueue_free(ctrlr->taskqueue); + ctrlr->taskqueue = NULL; + } + ufshci_sim_release_wlun_periph(ctrlr); mtx_lock(&ctrlr->sc_mtx);
