Re: [PATCH iwl-net v5 1/3] idpf: ignore Tx timestamp replies once removal has started

["Tantilov, Emil S" <emil.s.tantilov@intel.com>]

On 10/13/2026 5:12 AM, Tian Xun Ng wrote:
> From: Tian Xun Ng <tianxun.ng@bytedance.com>
> 
> On remove, idpf_vc_core_deinit() keeps the virtchnl transaction manager
> up until the vports have been torn down, so mbx_task keeps processing
> replies while idpf_ptp_release() frees the Tx timestamp trackers. An
> async VIRTCHNL2_OP_PTP_GET_VPORT_TX_TSTAMP reply handled in that window
> reaches idpf_ptp_get_tx_tstamp_async_handler(), which reads
> vport->tx_tstamp_caps and takes its lock after
> idpf_ptp_release_vport_tstamp() may already have freed it.
> 
> Once IDPF_REMOVE_IN_PROG is set, wait for a mailbox task that may be
> running a callback before releasing anything, and make the Tx timestamp
> callback return when the bit is set. Matched replies to synchronous
> transactions are not affected, so the vport teardown still receives
> them; mbx_task is requeued straight away for that.
> 
> The last patch of this series sets IDPF_REMOVE_IN_PROG on shutdown too,
> which would otherwise expose shutdown to the same window.
> 
> Fixes: 1a49cf814fe1 ("idpf: add Tx timestamp flows")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Tian Xun Ng <tianxun.ng@bytedance.com>
> ---
>   drivers/net/ethernet/intel/idpf/idpf_virtchnl.c     | 12 +++++++++++-
>   drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c |  3 ++-
>   2 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index 1caf52706..d0db60647 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -3204,8 +3204,18 @@ void idpf_vc_core_deinit(struct idpf_adapter *adapter)
>   
>   	/* Avoid transaction timeouts when called during reset */
>   	remove_in_prog = test_bit(IDPF_REMOVE_IN_PROG, adapter->flags);
> -	if (!remove_in_prog)
> +	if (!remove_in_prog) {
>   		libie_ctlq_xn_shutdown(adapter->xnm);
> +	} else {
> +		/* The transaction manager stays up for the teardown below, so
> +		 * async replies can still arrive. Wait for a mailbox task that
> +		 * may be running an async callback; callbacks that run later
> +		 * see IDPF_REMOVE_IN_PROG and leave the state released below
> +		 * alone.
> +		 */
> +		cancel_delayed_work_sync(&adapter->mbx_task);
> +		queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0);
> +	}
>   
>   	idpf_ptp_release(adapter);
>   	idpf_deinit_task(adapter);
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
> index 14dba40a9..1422b30d0 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl_ptp.c
> @@ -550,7 +550,8 @@ idpf_ptp_get_tx_tstamp_async_handler(void *ctx, struct kvec *mem, int status)
>   	u16 num_latches;
>   	u32 vport_id;
>   
> -	if (status)
> +	/* The Tx timestamp trackers are released on remove and shutdown */
> +	if (status || test_bit(IDPF_REMOVE_IN_PROG, adapter->flags))
>   		return;
>   
>   	recv_tx_tstamp_msg = mem->iov_base;

Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com>