hns_nic_dev_remove() unregisters the netdev and releases ring and AE resources before cancelling service_task. An already running service worker can therefore use the released ring or AE handle. Set NIC_STATE_REMOVING before teardown, join any in-flight TX watchdog callback which could have passed the scheduling check, and shut down the service timer before draining the work. Drain service_task before unregister_netdev() and resource teardown. Call cancel_work_sync() without holding RTNL, since the service worker may need to acquire it before completing. The service worker already takes RTNL for hns_nic_net_reinit(). Recheck the DOWN, REMOVING and RESETTING flags after taking RTNL: ndo_stop() may have run while the diagnostic dump was executing. Leave hns_nic_dump() outside the RTNL critical section because dumping all device registers can take a substantial amount of time. Fixes: b5996f11ea54 ("net: add Hisilicon Network Subsystem basic ethernet support") Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- v2: - Keep hns_nic_dump() outside RTNL and recheck state under RTNL. - Drop extra RTNL locking around the link-status update. - Leave notifier cleanup in its original location since the HNAE notifier does not directly queue the service work. drivers/net/ethernet/hisilicon/hns/hns_enet.c | 22 +++++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c @@ -2035,10 +2035,17 @@ (type == HNAE_PORT_DEBUG ? "debug" : "service")); rtnl_lock(); + /* ndo_stop may have run while the diagnostic dump was in progress. */ + if (test_bit(NIC_STATE_DOWN, &priv->state) || + test_bit(NIC_STATE_REMOVING, &priv->state) || + test_bit(NIC_STATE_RESETTING, &priv->state)) + goto out; + /* put off any impending NetWatchDogTimeout */ netif_trans_update(priv->netdev); hns_nic_net_reinit(priv->netdev); +out: rtnl_unlock(); } @@ -2397,6 +2404,18 @@ { struct net_device *ndev = platform_get_drvdata(pdev); struct hns_nic_priv *priv = netdev_priv(ndev); + + set_bit(NIC_STATE_REMOVING, &priv->state); + + /* Join any ndo_tx_timeout() which might have queued service_task. */ + if (ndev->reg_state != NETREG_UNINITIALIZED) { + netif_tx_lock_bh(ndev); + netif_tx_unlock_bh(ndev); + } + + /* Stop the timer producer before draining the service worker. */ + timer_shutdown_sync(&priv->service_timer); + cancel_work_sync(&priv->service_task); if (ndev->reg_state != NETREG_UNINITIALIZED) unregister_netdev(ndev); @@ -2415,9 +2434,6 @@ hnae_unregister_notifier(&priv->notifier_block); priv->notifier_block.notifier_call = NULL; - set_bit(NIC_STATE_REMOVING, &priv->state); - (void)cancel_work_sync(&priv->service_task); - /* safe for ACPI FW */ of_node_put(to_of_node(priv->fwnode)); -- 2.52.0