[PATCH net] net: dsa: mxl862xx: disable the stats poll on teardown

[Daniel Golle]

The WORK_STOPPED flag test in mxl862xx_get_stats64() and in the stats
poll's own re-arm is not atomic with the cancel in remove(), shutdown()
and the probe error path. A re-arm that read the flag before it was set
queues the work after cancel_delayed_work_sync() has returned, and the
poll then walks the port list while dsa_unregister_switch() frees it, or
runs against the devres-freed priv once remove() has returned.

Disable the work instead of cancelling it. disable_delayed_work_sync()
drains a running poll just as the cancel did, and every later attempt to
queue the work is a no-op, so neither re-arm can bring the poll back.

Fixes: a21d33a5265f ("net: dsa: mxl862xx: implement .get_stats64")
Assisted-by: LLM
Signed-off-by: Daniel Golle <daniel@xxxxxxxxxxxxxx>
---
Found by the Sashiko AI reviews of v11 and v12 of the mxl862xx devlink
flash series, where a first attempt to close this race by reordering
remove() only moved the window.

---
 drivers/net/dsa/mxl862xx/mxl862xx.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dsa/mxl862xx/mxl862xx.c b/drivers/net/dsa/mxl862xx/mxl862xx.c
index cfa7e3e269a2..a31ebbe451e0 100644
--- a/drivers/net/dsa/mxl862xx/mxl862xx.c
+++ b/drivers/net/dsa/mxl862xx/mxl862xx.c
@@ -2131,7 +2131,7 @@ static int mxl862xx_probe(struct mdio_device *mdiodev)
 	err = dsa_register_switch(ds);
 	if (err) {
 		set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
-		cancel_delayed_work_sync(&priv->stats_work);
+		disable_delayed_work_sync(&priv->stats_work);
 		mxl862xx_host_shutdown(priv);
 		for (i = 0; i < MXL862XX_MAX_PORTS; i++)
 			cancel_work_sync(&priv->ports[i].host_flood_work);
@@ -2152,7 +2152,7 @@ static void mxl862xx_remove(struct mdio_device *mdiodev)
 	priv = ds->priv;
 
 	set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
-	cancel_delayed_work_sync(&priv->stats_work);
+	disable_delayed_work_sync(&priv->stats_work);
 
 	dsa_unregister_switch(ds);
 
@@ -2181,7 +2181,7 @@ static void mxl862xx_shutdown(struct mdio_device *mdiodev)
 	dsa_switch_shutdown(ds);
 
 	set_bit(MXL862XX_FLAG_WORK_STOPPED, &priv->flags);
-	cancel_delayed_work_sync(&priv->stats_work);
+	disable_delayed_work_sync(&priv->stats_work);
 
 	mxl862xx_host_shutdown(priv);
 

base-commit: 38b6be101006d3e7af972999f45d4f1e8250587a
-- 
2.55.0