From c206fc0705d1050d9bce22ac4eb94bb062443cd6 Mon Sep 17 00:00:00 2001 From: Fan Wu Date: Wed, 5 Aug 2026 01:23:37 +0000 Subject: [PATCH] fjes: cancel force_close_task in fjes_remove() force_close_task runs on the system workqueue, which destroy_workqueue() does not drain, so it can run after free_netdev() and touch freed memory. Cancel it after destroying the workqueues, before free_netdev(). This issue was found by an in-house static analysis tool. Cc: stable+noautosel@kernel.org # untested fix to a driver init path race Signed-off-by: Fan Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260805012337.416908-1-fanwu01@zju.edu.cn Signed-off-by: Jakub Kicinski --- drivers/net/fjes/fjes_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c index cddabc9653b9..a2c77ca0d155 100644 --- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c @@ -1402,6 +1402,8 @@ static void fjes_remove(struct platform_device *plat_dev) if (adapter->txrx_wq) destroy_workqueue(adapter->txrx_wq); + cancel_work_sync(&adapter->force_close_task); + fjes_hw_exit(hw); netif_napi_del(&adapter->napi);