Transmit timeout and command submission paths can queue tx_timeout_task.
The worker accesses the MMIO mapping and netdev private state, but
device removal releases both without draining a pending instance.
Cancel the work after unregister_netdev(), when the network stack can no
longer publish it and after any RTNL serialization used by the worker
has completed.
Fixes: 2acdb1e05c1a ("[PATCH] e100: Execute tx_timeout task outside interrupt
context")
Signed-off-by: Hongyan Xu <[email protected]>
---
drivers/net/ethernet/intel/e100.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/e100.c
b/drivers/net/ethernet/intel/e100.c
index 29960762e64a..710c2c30d9ed 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -2988,6 +2988,7 @@ static void e100_remove(struct pci_dev *pdev)
if (netdev) {
struct nic *nic = netdev_priv(netdev);
unregister_netdev(netdev);
+ cancel_work_sync(&nic->tx_timeout_task);
e100_free(nic);
pci_iounmap(pdev, nic->csr);
dma_pool_destroy(nic->cbs_pool);
--
2.50.1.windows.1
