The EQ interrupt handler only schedules a tasklet. free_irq() prevents another interrupt handler from running, but it does not drain a tasklet that was queued before the IRQ was released. The pending tasklet can access the EQ DMA buffer and queue array after mlxsw_pci_aqs_fini() releases them. Kill it after freeing the IRQ and before tearing down the asynchronous queues. Fixes: eda6500a987a ("mlxsw: Add PCI bus implementation") Signed-off-by: Jiale Yao --- drivers/net/ethernet/mellanox/mlxsw/pci.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c index bfe3268dfdc1..ba66142ae333 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/pci.c +++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c @@ -2085,8 +2085,11 @@ static int mlxsw_pci_init(void *bus_priv, struct mlxsw_core *mlxsw_core, static void mlxsw_pci_fini(void *bus_priv) { struct mlxsw_pci *mlxsw_pci = bus_priv; + struct mlxsw_pci_queue *q; free_irq(pci_irq_vector(mlxsw_pci->pdev, 0), mlxsw_pci); + q = mlxsw_pci_eq_get(mlxsw_pci); + tasklet_kill(&q->u.eq.tasklet); mlxsw_pci_aqs_fini(mlxsw_pci); mlxsw_pci_napi_devs_fini(mlxsw_pci); mlxsw_pci_fw_area_fini(mlxsw_pci); -- 2.34.1