> -----Original Message-----
> From: Intel-wired-lan <[email protected]> On Behalf
> Of Larysa Zaremba
> Sent: Monday, March 23, 2026 6:41 PM
> To: [email protected]; Nguyen, Anthony L
> <[email protected]>
> Cc: Lobakin, Aleksander <[email protected]>; Samudrala,
> Sridhar <[email protected]>; Singhai, Anjali
> <[email protected]>; Michal Swiatkowski
> <[email protected]>; Zaremba, Larysa
> <[email protected]>; Fijalkowski, Maciej
> <[email protected]>; Tantilov, Emil S
> <[email protected]>; Chittim, Madhu <[email protected]>;
> Hay, Joshua A <[email protected]>; Keller, Jacob E
> <[email protected]>; Shanmugam, Jayaprakash
> <[email protected]>; Jiri Pirko <[email protected]>;
> David S. Miller <[email protected]>; Eric Dumazet
> <[email protected]>; Jakub Kicinski <[email protected]>; Paolo Abeni
> <[email protected]>; Simon Horman <[email protected]>; Jonathan Corbet
> <[email protected]>; Richard Cochran <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>; Andrew Lunn
> <[email protected]>; [email protected]; linux-
> [email protected]; [email protected]
> Subject: [Intel-wired-lan] [PATCH iwl-next v6 09/14] idpf: make
> mbx_task queueing and cancelling more consistent
>
> As a consequence of refactoring idpf code to use libeth APIs,
> idpf_vc_xn_shutdown was merged with and replaced by
> idpf_deinit_dflt_mbx.
> This does not affect the Tx path, as it checked for a presence of an
> xn manager anyway. Rx processing is handled by the mbx_task that is
> not always cancelled before calling the new consolidated mailbox
> deinit function.
> Moreover, in the reset path idpf_intr_rel() reschedules it after the
> deinit is done. This leads to mbx_task referencing the freed mailbox
> and causing KASAN warnings.
>
> To remedy this, in the init path, do the first queueing of mbx_task in
> idpf_init_dflt_mbx(), in deinit and reset, always cancel the task in
> idpf_deinit_dflt_mbx() and in every flow first call
> idpf_mb_intr_rel_irq().
>
> Reviewed-by: Emil Tantilov <[email protected]>
> Reviewed-by: Michal Kubiak <[email protected]>
> Signed-off-by: Larysa Zaremba <[email protected]>
> Tested-by: Samuel Salin <[email protected]>
> Signed-off-by: Tony Nguyen <[email protected]>
> ---
> drivers/net/ethernet/intel/idpf/idpf.h | 1 +
> drivers/net/ethernet/intel/idpf/idpf_lib.c | 9 ++++-----
> drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++++-
> 3 files changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf.h
> b/drivers/net/ethernet/intel/idpf/idpf.h
> index b06640925fb9..9606c0de018f 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf.h
> +++ b/drivers/net/ethernet/intel/idpf/idpf.h
> @@ -984,6 +984,7 @@ void idpf_vc_event_task(struct work_struct *work);
> void idpf_dev_ops_init(struct idpf_adapter *adapter); void
> idpf_vf_dev_ops_init(struct idpf_adapter *adapter); int
> idpf_intr_req(struct idpf_adapter *adapter);
> +void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter);
> void idpf_intr_rel(struct idpf_adapter *adapter);
> u16 idpf_get_max_tx_hdr_size(struct idpf_adapter *adapter); int
> idpf_initiate_soft_reset(struct idpf_vport *vport, diff --git
> a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> index 0d131bf0993e..7988836fbae0 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> @@ -68,9 +68,11 @@ static void idpf_deinit_vector_stack(struct
> idpf_adapter *adapter)
> * This will also disable interrupt mode and queue up mailbox task.
> Mailbox
> * task will reschedule itself if not in interrupt mode.
> */
> -static void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter)
> +void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter)
> {
> - clear_bit(IDPF_MB_INTR_MODE, adapter->flags);
> + if (!test_and_clear_bit(IDPF_MB_INTR_MODE, adapter->flags))
> + return;
> +
> kfree(free_irq(adapter->msix_entries[0].vector, adapter));
> queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0); }
> @@ -1938,14 +1940,11 @@ static void idpf_init_hard_reset(struct
> idpf_adapter *adapter)
> goto unlock_mutex;
> }
>
> - queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0);
> -
> /* Initialize the state machine, also allocate memory and
> request
> * resources
> */
> err = idpf_vc_core_init(adapter);
> if (err) {
> - cancel_delayed_work_sync(&adapter->mbx_task);
> idpf_deinit_dflt_mbx(adapter);
> goto unlock_mutex;
> }
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index 6d847aea00e4..38d119147ab6 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -2974,6 +2974,8 @@ int idpf_init_dflt_mbx(struct idpf_adapter
> *adapter)
> adapter->xnm = params.xnm;
> adapter->state = __IDPF_VER_CHECK;
>
> + queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0);
> +
> return 0;
> }
>
> @@ -2983,6 +2985,9 @@ int idpf_init_dflt_mbx(struct idpf_adapter
> *adapter)
> */
> void idpf_deinit_dflt_mbx(struct idpf_adapter *adapter) {
> + idpf_mb_intr_rel_irq(adapter);
> + cancel_delayed_work_sync(&adapter->mbx_task);
> +
> if (adapter->arq && adapter->asq) {
> idpf_mb_clean(adapter, adapter->asq, true);
> libie_ctlq_xn_deinit(adapter->xnm, &adapter->ctlq_ctx);
> @@ -3237,7 +3242,6 @@ void idpf_vc_core_deinit(struct idpf_adapter
> *adapter)
> idpf_deinit_dflt_mbx(adapter);
>
> cancel_delayed_work_sync(&adapter->serv_task);
> - cancel_delayed_work_sync(&adapter->mbx_task);
>
> idpf_vport_params_buf_rel(adapter);
>
> --
> 2.47.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
