Re: [Intel-wired-lan] [PATCH iwl-net v1] igb/igbvf: disable work items before device removal

> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf
> Of [email protected]
> Sent: Tuesday, July 21, 2026 12:36 PM
> To: [email protected]
> Cc: Nguyen, Anthony L <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>; [email protected];
> [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected]; Xuanqiang
> Luo <[email protected]>; [email protected]
> Subject: [Intel-wired-lan] [PATCH iwl-net v1] igb/igbvf: disable work
> items before device removal
> 
> From: Xuanqiang Luo <[email protected]>
> 
> A watchdog work item that is already running can queue the reset work
> after the remove path has canceled it. The netdev Tx timeout handler
> can also queue the reset work until unregister_netdev() shuts the
> interface down.
> In igb, device reset interrupts provide another enqueue path. The
> reset work may then run after free_netdev(), resulting in access to
> the freed adapter memory.
> 
> Although igb_reset_task() checks __IGB_DOWN, checking the bit already
> dereferences the adapter and therefore cannot protect its lifetime.
> 
> Disable the watchdog work first and the reset work second in both
> drivers.
> Disabling the work items also prevents racing attempts to queue them
> during device removal.
> 
> Fixes: 760141a53e5d ("igb[v],ixgbe: don't use flush_scheduled_work()")
> Cc: [email protected]
> Signed-off-by: Xuanqiang Luo <[email protected]>
> ---
>  drivers/net/ethernet/intel/igb/igb_main.c | 4 ++--
> drivers/net/ethernet/intel/igbvf/netdev.c | 4 ++--
>  2 files changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igb/igb_main.c
> b/drivers/net/ethernet/intel/igb/igb_main.c
> index a1e89a375744c..5ffc0ad318914 100644
> --- a/drivers/net/ethernet/intel/igb/igb_main.c
> +++ b/drivers/net/ethernet/intel/igb/igb_main.c
> @@ -3887,8 +3887,8 @@ static void igb_remove(struct pci_dev *pdev)
>  	timer_delete_sync(&adapter->watchdog_timer);
>  	timer_delete_sync(&adapter->phy_info_timer);
> 
> -	cancel_work_sync(&adapter->reset_task);
> -	cancel_work_sync(&adapter->watchdog_task);
> +	disable_work_sync(&adapter->watchdog_task);
> +	disable_work_sync(&adapter->reset_task);
> 
>  #ifdef CONFIG_IGB_DCA
>  	if (adapter->flags & IGB_FLAG_DCA_ENABLED) { diff --git
> a/drivers/net/ethernet/intel/igbvf/netdev.c
> b/drivers/net/ethernet/intel/igbvf/netdev.c
> index ec308a5f5302a..c5ae15fcdca75 100644
> --- a/drivers/net/ethernet/intel/igbvf/netdev.c
> +++ b/drivers/net/ethernet/intel/igbvf/netdev.c
> @@ -2906,8 +2906,8 @@ static void igbvf_remove(struct pci_dev *pdev)
>  	set_bit(__IGBVF_DOWN, &adapter->state);
>  	timer_delete_sync(&adapter->watchdog_timer);
> 
> -	cancel_work_sync(&adapter->reset_task);
> -	cancel_work_sync(&adapter->watchdog_task);
> +	disable_work_sync(&adapter->watchdog_task);
> +	disable_work_sync(&adapter->reset_task);
> 
>  	unregister_netdev(netdev);
> 
> --
> 2.43.0

Reviewed-by: Aleksandr Loktionov <[email protected]>