atl1_reset_dev_task is scheduled from the interrupt handler on PCIe PHY link down and DMA read/write errors, and link_chg_task can be pending from link events. atl1_remove() tears down and frees the net_device without cancelling either work, so a work scheduled just before unregister_netdev() can run after free_netdev() and touch the freed adapter. Cancel both works before unregistering the net_device, as atl2_remove() already does for its reset and link works. Fixes: 03662e41c7cf ("atl1: fix kernel panic in case of DMA errors") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- Remove-side work cancellation, matching what atl2_remove() already does for its reset and link works: the IRQ handler schedules reset_dev_task on PCIe PHY link down and DMA errors, and link events schedule link_chg_task, but atl1_remove() frees the net_device without cancelling either work. --- drivers/net/ethernet/atheros/atlx/atl1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c index 98a4d089270e..b49353a94f5e 100644 --- a/drivers/net/ethernet/atheros/atlx/atl1.c +++ b/drivers/net/ethernet/atheros/atlx/atl1.c @@ -3128,6 +3128,9 @@ static void atl1_remove(struct pci_dev *pdev) adapter = netdev_priv(netdev); + cancel_work_sync(&adapter->reset_dev_task); + cancel_work_sync(&adapter->link_chg_task); + /* * Some atl1 boards lack persistent storage for their MAC, and get it * from the BIOS during POST. If we've been messing with the MAC --- base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229 change-id: 20260827-atl1-cancel-reset-work-54fe8746c623 Best regards, -- Shengzhuo Wei