diff options
| author | Fan Wu <fanwu01@zju.edu.cn> | 2026-08-05 01:23:37 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-08-06 09:19:58 -0700 |
| commit | c206fc0705d1050d9bce22ac4eb94bb062443cd6 (patch) | |
| tree | b350af9d2903bf1f5d7075e0bb97bf7ea6aa8b4c | |
| parent | f2473fbfc3fd8d07142069bcd68316e26cdad59e (diff) | |
fjes: cancel force_close_task in fjes_remove()
force_close_task runs on the system workqueue, which destroy_workqueue()
does not drain, so it can run after free_netdev() and touch freed memory.
Cancel it after destroying the workqueues, before free_netdev().
This issue was found by an in-house static analysis tool.
Cc: stable+noautosel@kernel.org # untested fix to a driver init path race
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260805012337.416908-1-fanwu01@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | drivers/net/fjes/fjes_main.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c index cddabc9653b9..a2c77ca0d155 100644 --- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c @@ -1402,6 +1402,8 @@ static void fjes_remove(struct platform_device *plat_dev) if (adapter->txrx_wq) destroy_workqueue(adapter->txrx_wq); + cancel_work_sync(&adapter->force_close_task); + fjes_hw_exit(hw); netif_napi_del(&adapter->napi); |