[PATCH net] net: sungem: shut down the link timer before freeing device state

[Myeonghun Pak]

The ethtool link-settings and nway-reset callbacks can restart
link_timer when the interface is administratively down. They test device
presence, but not whether the interface is running.
gem_begin_auto_negotiation() then arms the timer.

When such a device is removed, unregister_netdev() skips ndo_stop() for
the already-down interface. The timer is consequently still pending when
gem_remove_one() cancels reset_task and frees the device state. Its
callback can then access the freed private data and MMIO mapping. It is
also a producer of reset_task.

Shut down the link timer after unregister_netdev() and before cancelling
reset_task. This waits for a running timer callback and prevents it from
rearming, so the final work cancellation follows the last timer
producer. Keep ordinary close and suspend timer cancellation
restartable.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: fe09bb619096 ("sungem: Spring cleaning and GRO support")
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

---
Compile-tested with Clang, W=1. No hardware runtime testing.

Based on mainline 0fcb05b72344f40806cbe810de8872f1698bf053.

diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index dc5638d..e8d3ac7 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2797,6 +2797,9 @@ static void gem_remove_one(struct pci_dev *pdev)
 
 		unregister_netdev(dev);
 
+		/* Link settings can restart the timer while the interface is down. */
+		timer_shutdown_sync(&gp->link_timer);
+
 		/* Ensure reset task is truly gone */
 		cancel_work_sync(&gp->reset_task);