1 files changed, 17 insertions, 2 deletions

diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index e8ba67834746..00bf4b17edbf 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -214,6 +214,9 @@ struct ipmi_user {
 
         /* Does this interface receive IPMI events? */
         bool gets_events;
+
+        /* Free must run in process context for RCU cleanup. */
+        struct work_struct remove_work;
 };
 
 static struct ipmi_user *acquire_ipmi_user(struct ipmi_user *user, int *index)
@@ -1157,6 +1160,15 @@ static int intf_err_seq(struct ipmi_smi *intf,
         return rv;
 }
 
+static void free_user_work(struct work_struct *work)
+{
+        struct ipmi_user *user = container_of(work, struct ipmi_user,
+                                              remove_work);
+
+        cleanup_srcu_struct(&user->release_barrier);
+        kfree(user);
+}
+
 int ipmi_create_user(unsigned int          if_num,
                      const struct ipmi_user_hndl *handler,
                      void                  *handler_data,
@@ -1200,6 +1212,8 @@ int ipmi_create_user(unsigned int          if_num,
         goto out_kfree;
 
  found:
+        INIT_WORK(&new_user->remove_work, free_user_work);
+
         rv = init_srcu_struct(&new_user->release_barrier);
         if (rv)
                 goto out_kfree;
@@ -1260,8 +1274,9 @@ EXPORT_SYMBOL(ipmi_get_smi_info);
 static void free_user(struct kref *ref)
 {
         struct ipmi_user *user = container_of(ref, struct ipmi_user, refcount);
-        cleanup_srcu_struct(&user->release_barrier);
-        kfree(user);
+
+        /* SRCU cleanup must happen in task context. */
+        schedule_work(&user->remove_work);
 }
 
 static void _ipmi_destroy_user(struct ipmi_user *user)