[PATCH net] net: wwan: mhi_wwan_mbim: disable rx_refill work on removal

[Myeonghun Pak]

mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: stable@xxxxxxxxxxxxxxx # v6.10+
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>

---

diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index 336f89756f10..3b6b0066f673 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c
@@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
 	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
 
 	mhi_unprepare_from_transfer(mhi_dev);
-	cancel_delayed_work_sync(&mbim->rx_refill);
+	disable_delayed_work_sync(&mbim->rx_refill);
 	wwan_unregister_ops(&cntrl->mhi_dev->dev);
 	kfree_skb(mbim->skbagg_head);
 	dev_set_drvdata(&mhi_dev->dev, NULL);

base-commit: 0edbc945eb9edd0086f25b151a79cfe4adc0dfa8
-- 
2.43.0