enc28j60_remove() frees the net_device without cancelling the tx_work, setrx_work, and restart_work items the ndo callbacks queue, so a work racing with remove can run after free_netdev(). A queued tx skb is also left waiting for its transmit-complete interrupt, which never arrives, and leaks. Unregister the netdev, free the IRQ, and cancel the works before freeing the net_device, and release the leftover tx skb. Fixes: 3ec9c11da033 ("add driver for enc28j60 ethernet chip") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- Found by source inspection. Compile-tested with CONFIG_SPI_ENC28J60=y and W=1; no ENC28J60 hardware was available, so no runtime reproducer or hardware test was performed. --- drivers/net/ethernet/microchip/enc28j60.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/microchip/enc28j60.c b/drivers/net/ethernet/microchip/enc28j60.c index d6c9491537e4..d16564060fbc 100644 --- a/drivers/net/ethernet/microchip/enc28j60.c +++ b/drivers/net/ethernet/microchip/enc28j60.c @@ -1602,6 +1602,11 @@ static void enc28j60_remove(struct spi_device *spi) unregister_netdev(priv->netdev); free_irq(spi->irq, priv); + cancel_work_sync(&priv->tx_work); + cancel_work_sync(&priv->setrx_work); + cancel_work_sync(&priv->restart_work); + if (priv->tx_skb) + dev_kfree_skb(priv->tx_skb); free_netdev(priv->netdev); } --- base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229 change-id: 20260827-enc28j60-cancel-works-62a0e02806af Best regards, -- Shengzhuo Wei