[PATCH net] enic: fix tx_hang_reset use-after-free on device removal

[PATCH net] enic: fix tx_hang_reset use-after-free on device removal

[Satish Kharat]

enic_remove() cancels the reset and change_mtu_work items but does not
cancel tx_hang_reset. A TX timeout that fires while the device is being
removed can schedule enic_tx_hang_reset() so that it runs after
free_netdev(), resulting in a use-after-free.

cancel_work_sync() alone is not sufficient here: the still-live watchdog
and notify paths can re-schedule these work items in the window between
the cancel and unregister_netdev(). Use disable_work_sync(), which
cancels the work and blocks any subsequent schedule_work() from
requeuing it, and apply it to the reset and change_mtu_work items as
well so the same requeue race is closed for all teardown work.

Fixes: 937317c7c109 ("enic: do hang reset only in case of tx timeout")
Signed-off-by: Satish Kharat <satishkh@cisco.com>
---
 drivers/net/ethernet/cisco/enic/enic_main.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index e839081f9ee4..3f384b481ff0 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -2956,8 +2956,9 @@ static void enic_remove(struct pci_dev *pdev)
 	if (netdev) {
 		struct enic *enic = netdev_priv(netdev);
 
-		cancel_work_sync(&enic->reset);
-		cancel_work_sync(&enic->change_mtu_work);
+		disable_work_sync(&enic->reset);
+		disable_work_sync(&enic->tx_hang_reset);
+		disable_work_sync(&enic->change_mtu_work);
 		unregister_netdev(netdev);
 		enic_dev_deinit(enic);
 		vnic_dev_close(enic->vdev);
-- 
2.43.0

Re: [PATCH net] enic: fix tx_hang_reset use-after-free on device removal

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 27 Jul 2026 23:26:30 -0700 you wrote:
> enic_remove() cancels the reset and change_mtu_work items but does not
> cancel tx_hang_reset. A TX timeout that fires while the device is being
> removed can schedule enic_tx_hang_reset() so that it runs after
> free_netdev(), resulting in a use-after-free.
> 
> cancel_work_sync() alone is not sufficient here: the still-live watchdog
> and notify paths can re-schedule these work items in the window between
> the cancel and unregister_netdev(). Use disable_work_sync(), which
> cancels the work and blocks any subsequent schedule_work() from
> requeuing it, and apply it to the reset and change_mtu_work items as
> well so the same requeue race is closed for all teardown work.
> 
> [...]

Here is the summary with links:
  - [net] enic: fix tx_hang_reset use-after-free on device removal
    https://git.kernel.org/netdev/net/c/ec680ea4ba1b

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html