Re: [PATCH net] net: wwan: mhi_wwan_mbim: disable rx_refill work on removal

[Jakub Kicinski <kuba@kernel.org>]

On Mon,  9 Nov 2026 23:30:06 -0500 Myeonghun Pak wrote:
> mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
> removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
> and queues the work again. With the MHI channels already reset, the
> work cannot refill RX buffers and keeps re-arming itself, eventually
> running after devres frees the context.
> 
> Use disable_delayed_work_sync() to drain the work and reject later
> queueing. Probe initializes fresh work on rebind.
> 
> Found by a static analysis tool under development.
> 
> Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
> Cc: stable@vger.kernel.org # v6.10+
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> 
> ---
> 
> diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
> index 336f89756f10..3b6b0066f673 100644
> --- a/drivers/net/wwan/mhi_wwan_mbim.c
> +++ b/drivers/net/wwan/mhi_wwan_mbim.c
> @@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
>  	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
>  
>  	mhi_unprepare_from_transfer(mhi_dev);
> -	cancel_delayed_work_sync(&mbim->rx_refill);
> +	disable_delayed_work_sync(&mbim->rx_refill);
>  	wwan_unregister_ops(&cntrl->mhi_dev->dev);
>  	kfree_skb(mbim->skbagg_head);
>  	dev_set_drvdata(&mhi_dev->dev, NULL);

AI says this is not enough for make the teardown correct:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261110043006.56681-1-mhun512@gmail.com
-- 
pw-bot: cr