[PATCH] atlx: atl1: cancel reset and link works on remove

[Shengzhuo Wei]

atl1_reset_dev_task is scheduled from the interrupt handler on PCIe
PHY link down and DMA read/write errors, and link_chg_task can be
pending from link events. atl1_remove() tears down and frees the
net_device without cancelling either work, so a work scheduled just
before unregister_netdev() can run after free_netdev() and touch the
freed adapter.

Cancel both works before unregistering the net_device, as atl2_remove()
already does for its reset and link works.

Fixes: 03662e41c7cf ("atl1: fix kernel panic in case of DMA errors")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
Remove-side work cancellation, matching what atl2_remove() already
does for its reset and link works: the IRQ handler schedules
reset_dev_task on PCIe PHY link down and DMA errors, and link events
schedule link_chg_task, but atl1_remove() frees the net_device without
cancelling either work.
---
 drivers/net/ethernet/atheros/atlx/atl1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
index 98a4d089270e..b49353a94f5e 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
@@ -3128,6 +3128,9 @@ static void atl1_remove(struct pci_dev *pdev)
 
 	adapter = netdev_priv(netdev);
 
+	cancel_work_sync(&adapter->reset_dev_task);
+	cancel_work_sync(&adapter->link_chg_task);
+
 	/*
 	 * Some atl1 boards lack persistent storage for their MAC, and get it
 	 * from the BIOS during POST.  If we've been messing with the MAC

---
base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
change-id: 20260827-atl1-cancel-reset-work-54fe8746c623

Best regards,
--  
Shengzhuo Wei <me@xxxxxxxx>