Re: [PATCH net-next v12 01/12] enic: cancel tx_hang_reset work on device removal

[Jakub Kicinski <kuba@kernel.org>]

On Sun, 19 Jul 2026 01:41:45 -0700 Satish Kharat wrote:
> enic_remove() cancels the reset and change_mtu_work items but does not
> cancel tx_hang_reset.  A TX timeout that fires while the device is being
> removed can schedule enic_tx_hang_reset() so that it runs after
> free_netdev(), resulting in a use-after-free.
> 
> Cancel tx_hang_reset alongside the other work items before
> unregister_netdev().
> 
> This is a pre-existing issue, not introduced by the SR-IOV V2 series;
> it is included here as an independent fix.
> 
> Fixes: 937317c7c109 ("enic: do hang reset only in case of tx timeout")
> Signed-off-by: Satish Kharat <satishkh@cisco.com>

Since this is a fix it should go separately to the net tree.
If there is a conflict the net-next submission will have to wait for
the fix to propagate there.

> diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
> index e7125b818087..b65796d96efc 100644
> --- a/drivers/net/ethernet/cisco/enic/enic_main.c
> +++ b/drivers/net/ethernet/cisco/enic/enic_main.c
> @@ -3012,6 +3012,7 @@ static void enic_remove(struct pci_dev *pdev)
>  		struct enic *enic = netdev_priv(netdev);
>  
>  		cancel_work_sync(&enic->reset);
> +		cancel_work_sync(&enic->tx_hang_reset);

Is this enough? The work may get scheduled between the cancel and 
the unregister, right? disable_work_sync() is probably the answer.

>  		cancel_work_sync(&enic->change_mtu_work);
>  		unregister_netdev(netdev);
>  		enic_dev_deinit(enic);
-- 
pw-bot: cr