Re: [PATCH net v6 2/4] net: wwan: t7xx: do not exit the TX push kthread on resume failure

[Andreas Haerter]

On Fri, Oct 02, 2026 at 09:46:36AM +0800, Tim JH Chen wrote:
> A later
> t7xx_dpmaif_tx_thread_rel() then calls kthread_stop() on the stale
> pointer [...]

I hit this in normal use on a ThinkPad X13 Gen 6 with a Rolling
RW350R-GL (14c3:4d75, subsystem 2099:3552), on Fedora's 7.2.4 and
7.2.5.

A runtime suspend failed with "[PM] SAP suspend error: -110". After
that, every MBIM write failed with -22 and the modem stayed dead.
Writing to the PCI remove attribute then gave a WARNING at
kernel/kthread.c:84 and, on a later occurrence, this oops:

  BUG: kernel NULL pointer dereference, address: 0000000000000000
  #PF: supervisor write access in kernel mode
  RIP: 0010:kthread_stop+0x44/0x180
  Call Trace:
   t7xx_dpmaif_hif_exit+0x46/0xa0 [mtk_t7xx]
   t7xx_md_exit+0x5c/0xa0 [mtk_t7xx]
   t7xx_pci_remove+0x41/0xc0 [mtk_t7xx]
   pci_device_remove+0x4a/0xb0
   device_release_driver_internal+0x19e/0x200
   pci_stop_bus_device+0x80/0xa0
   pci_stop_and_remove_bus_device_locked+0x1a/0x30
   remove_store+0x83/0xa0

The faulting instruction is the set_bit of KTHREAD_SHOULD_STOP with
worker_private NULL, so the pointer no longer referred to a kthread.
The writing process stayed in D state holding pci_rescan_remove_lock.
Shutdown then hung and the machine needed a forced power-off, which may
be worth a line in the changelog.

One question on the retry. In my case the failure is permanent:
runtime_error is latched, so rpm_resume() returns -EINVAL from then on.
With this patch the crash goes away, but TX stays dead and the thread
retries every 20 ms for as long as the TX lists are non-empty. Is that
the intended end state, or should something report the dead data path?

I have no reproducer, so I cannot offer a Tested-by.

Thanks,
Andreas

-- 
foundata GmbH
Steinhäuserstr. 20
76135 Karlsruhe

Web: https://foundata.com
Sitz der Gesellschaft: Karlsruhe
Registergericht: Amtsgericht Mannheim, HRB 714807
Geschäftsführung: Andreas Haerter
USt-IdNr.: DE284122682