[PATCH net 1/2] fjes: unregister the netdev before destroying the workqueues

[PATCH net 1/2] fjes: unregister the netdev before destroying the workqueues

[Fan Wu]

fjes_remove() destroys the driver workqueues before unregistering the
netdev. The interrupt handler queues work on them, but the IRQ is only
freed from fjes_close() under unregister_netdev(), so an interrupt in that
window can queue work once the workqueues are gone.

Unregister the netdev first so fjes_close() frees the IRQ and cancels the
workers before the workqueues are destroyed. force_close_task, which the
workers arm on the system workqueue, is handled in the next patch.

This issue was found by an in-house static analysis tool.

Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/net/fjes/fjes_main.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index 1f0f38980..cddabc965 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1394,17 +1394,14 @@ static void fjes_remove(struct platform_device *plat_dev)
 
 	fjes_dbg_adapter_exit(adapter);
 
-	cancel_delayed_work_sync(&adapter->interrupt_watch_task);
-	cancel_work_sync(&adapter->unshare_watch_task);
-	cancel_work_sync(&adapter->raise_intr_rxdata_task);
-	cancel_work_sync(&adapter->tx_stall_task);
+	/* Unregister first: .ndo_stop frees the IRQ and cancels the workers. */
+	unregister_netdev(netdev);
+
 	if (adapter->control_wq)
 		destroy_workqueue(adapter->control_wq);
 	if (adapter->txrx_wq)
 		destroy_workqueue(adapter->txrx_wq);
 
-	unregister_netdev(netdev);
-
 	fjes_hw_exit(hw);
 
 	netif_napi_del(&adapter->napi);
-- 
2.34.1

[PATCH net 2/2] fjes: cancel force_close_task in fjes_remove()

[Fan Wu]

force_close_task runs on the system workqueue, which destroy_workqueue()
does not drain, so it can run after free_netdev() and touch freed memory.
Cancel it after destroying the workqueues, before free_netdev().

This issue was found by an in-house static analysis tool.

Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/net/fjes/fjes_main.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
index cddabc965..a2c77ca0d 100644
--- a/drivers/net/fjes/fjes_main.c
+++ b/drivers/net/fjes/fjes_main.c
@@ -1402,6 +1402,8 @@ static void fjes_remove(struct platform_device *plat_dev)
 	if (adapter->txrx_wq)
 		destroy_workqueue(adapter->txrx_wq);
 
+	cancel_work_sync(&adapter->force_close_task);
+
 	fjes_hw_exit(hw);
 
 	netif_napi_del(&adapter->napi);
-- 
2.34.1

Re: [PATCH net 2/2] fjes: cancel force_close_task in fjes_remove()

[Simon Horman]

On Wed, Aug 05, 2026 at 01:23:37AM +0000, Fan Wu wrote:
> force_close_task runs on the system workqueue, which destroy_workqueue()
> does not drain, so it can run after free_netdev() and touch freed memory.
> Cancel it after destroying the workqueues, before free_netdev().
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net 1/2] fjes: unregister the netdev before destroying the workqueues

[Simon Horman]

On Wed, Aug 05, 2026 at 01:14:09AM +0000, Fan Wu wrote:
> fjes_remove() destroys the driver workqueues before unregistering the
> netdev. The interrupt handler queues work on them, but the IRQ is only
> freed from fjes_close() under unregister_netdev(), so an interrupt in that
> window can queue work once the workqueues are gone.
> 
> Unregister the netdev first so fjes_close() frees the IRQ and cancels the
> workers before the workqueues are destroyed. force_close_task, which the
> workers arm on the system workqueue, is handled in the next patch.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Simon Horman <horms@kernel.org>

Re: [PATCH net 1/2] fjes: unregister the netdev before destroying the workqueues

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  5 Aug 2026 01:14:09 +0000 you wrote:
> fjes_remove() destroys the driver workqueues before unregistering the
> netdev. The interrupt handler queues work on them, but the IRQ is only
> freed from fjes_close() under unregister_netdev(), so an interrupt in that
> window can queue work once the workqueues are gone.
> 
> Unregister the netdev first so fjes_close() frees the IRQ and cancels the
> workers before the workqueues are destroyed. force_close_task, which the
> workers arm on the system workqueue, is handled in the next patch.
> 
> [...]

Here is the summary with links:
  - [net,1/2] fjes: unregister the netdev before destroying the workqueues
    https://git.kernel.org/netdev/net-next/c/f2473fbfc3fd
  - [net,2/2] fjes: cancel force_close_task in fjes_remove()
    https://git.kernel.org/netdev/net-next/c/c206fc0705d1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html