On 10/4/2026 4:43 AM, Runyu Xiao wrote:
> The fm10k service timer rearms itself from its callback. During PCI
> removal, timer_delete_sync() waits for a running callback but does not
> prevent a callback or another service path from rearming the timer. This
> can leave the timer referencing the fm10k_intfc after free_netdev().
>
> Use timer_shutdown_sync() to permanently prevent rearming before teardown
> continues.
>
> The issue was identified by code inspection. No runtime reproduction or
> trace demonstrating the failure is available.
>
> The patch was not tested on real hardware. No hardware- or
> firmware-specific runtime result is available. Validation used source
> review and available build or emulation checks.
>
> Fixes: 54b3c9cfad6b ("fm10k: start service timer on probe")
> Cc: [email protected]
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <[email protected]>
> ---
> drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> index f5b4d0627..836664cfd 100644
> --- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> +++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> @@ -2245,7 +2245,7 @@ static void fm10k_remove(struct pci_dev *pdev)
> struct fm10k_intfc *interface = pci_get_drvdata(pdev);
> struct net_device *netdev = interface->netdev;
>
> - timer_delete_sync(&interface->service_timer);
> + timer_shutdown_sync(&interface->service_timer);
>
I don't think I have access to hardware to test this anymore :\, but...
Acked-by: Jacob Keller <[email protected]>
> fm10k_stop_service_event(interface);
> fm10k_stop_macvlan_task(interface);
