[PATCH net] net: enc28j60: fix use-after-free on remove

[Shengzhuo Wei]

enc28j60_remove() frees the net_device without cancelling the
tx_work, setrx_work, and restart_work items the ndo callbacks queue,
so a work racing with remove can run after free_netdev(). A queued
tx skb is also left waiting for its transmit-complete interrupt,
which never arrives, and leaks.

Unregister the netdev, free the IRQ, and cancel the works before
freeing the net_device, and release the leftover tx skb.

Fixes: 3ec9c11da033 ("add driver for enc28j60 ethernet chip")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@xxxxxxxx>
---
Found by source inspection. Compile-tested with
CONFIG_SPI_ENC28J60=y and W=1; no ENC28J60 hardware was available,
so no runtime reproducer or hardware test was performed.
---
 drivers/net/ethernet/microchip/enc28j60.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/microchip/enc28j60.c b/drivers/net/ethernet/microchip/enc28j60.c
index d6c9491537e4..d16564060fbc 100644
--- a/drivers/net/ethernet/microchip/enc28j60.c
+++ b/drivers/net/ethernet/microchip/enc28j60.c
@@ -1602,6 +1602,11 @@ static void enc28j60_remove(struct spi_device *spi)
 
 	unregister_netdev(priv->netdev);
 	free_irq(spi->irq, priv);
+	cancel_work_sync(&priv->tx_work);
+	cancel_work_sync(&priv->setrx_work);
+	cancel_work_sync(&priv->restart_work);
+	if (priv->tx_skb)
+		dev_kfree_skb(priv->tx_skb);
 	free_netdev(priv->netdev);
 }
 

---
base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
change-id: 20260827-enc28j60-cancel-works-62a0e02806af

Best regards,
--  
Shengzhuo Wei <me@xxxxxxxx>