ibmveth_remove() cancels the reset work before unregister_netdev(), but NAPI keeps running until unregister closes the device and can queue the reset again, on an interrupt enable failure, a bad free_map entry or a bad RX slot. The reset can then run on the adapter after free_netdev(), or reopen the device during unregister. Use disable_work_sync(), which waits for a running reset and keeps the work from being queued again. A bad RX slot also makes poll spin, which can stall unregister; a later patch in this series fixes that. It was not reproduced. Tested on a POWER10 LPAR with unbind and bind cycles under traffic. Fixes: 2c91e2319ed9 ("net: ibmveth: Reset the adapter when unexpected states are detected") Signed-off-by: Mingming Cao --- drivers/net/ethernet/ibm/ibmveth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c index 00cee2916920..77d3740cc52a 100644 --- a/drivers/net/ethernet/ibm/ibmveth.c +++ b/drivers/net/ethernet/ibm/ibmveth.c @@ -1950,7 +1950,7 @@ static void ibmveth_remove(struct vio_dev *dev) struct ibmveth_adapter *adapter = netdev_priv(netdev); int i; - cancel_work_sync(&adapter->work); + disable_work_sync(&adapter->work); for (i = 0; i < IBMVETH_NUM_BUFF_POOLS; i++) kobject_put(&adapter->rx_buff_pool[i].kobj); -- 2.39.3 (Apple Git-146)