linux/drivers/net/ethernet/cisco/enic
Satish Kharat ec680ea4ba enic: fix tx_hang_reset use-after-free on device removal
enic_remove() cancels the reset and change_mtu_work items but does not
cancel tx_hang_reset. A TX timeout that fires while the device is being
removed can schedule enic_tx_hang_reset() so that it runs after
free_netdev(), resulting in a use-after-free.

cancel_work_sync() alone is not sufficient here: the still-live watchdog
and notify paths can re-schedule these work items in the window between
the cancel and unregister_netdev(). Use disable_work_sync(), which
cancels the work and blocks any subsequent schedule_work() from
requeuing it, and apply it to the reset and change_mtu_work items as
well so the same requeue race is closed for all teardown work.

Fixes: 937317c7c1 ("enic: do hang reset only in case of tx timeout")
Signed-off-by: Satish Kharat <satishkh@cisco.com>
Link: https://patch.msgid.link/20260728062730.2394873-1-satishkh@cisco.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-30 16:41:22 -07:00
..
cq_desc.h enic: added enic_wq.c and enic_wq.h 2025-03-11 10:21:32 +01:00
cq_enet_desc.h enic: remove unused function cq_enet_wq_desc_dec 2025-03-11 10:21:27 +01:00
enic_api.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
enic_api.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
enic_clsf.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
enic_clsf.h treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
enic_dev.c enic: make enic_dev_enable/disable ref-counted 2026-04-02 18:05:06 -07:00
enic_dev.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
enic_ethtool.c net:ethernet:enic: map ethtool link modes by VIC type 2026-02-24 17:20:11 -08:00
enic_main.c enic: fix tx_hang_reset use-after-free on device removal 2026-07-30 16:41:22 -07:00
enic_pp.c treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
enic_pp.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
enic_res.c enic: detect admin channel resources for SR-IOV 2026-04-02 18:05:06 -07:00
enic_res.h enic: get max rq & wq entries supported by hw, 16K queues 2025-03-11 10:21:38 +01:00
enic_rq.c enic: enable rq extended cq support 2025-03-11 10:21:15 +01:00
enic_rq.h enic: enic rq code reorg 2025-03-11 10:21:15 +01:00
enic_wq.c enic: get max rq & wq entries supported by hw, 16K queues 2025-03-11 10:21:38 +01:00
enic_wq.h enic: cleanup of enic wq request completion path 2025-03-11 10:21:34 +01:00
enic.h enic: detect admin channel resources for SR-IOV 2026-04-02 18:05:06 -07:00
Kconfig enic: add dependency on Page Pool 2025-02-25 19:08:21 -08:00
Makefile enic: added enic_wq.c and enic_wq.h 2025-03-11 10:21:32 +01:00
rq_enet_desc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
vnic_cq.c enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_cq.h enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_dev.c enic: extend resource discovery for SR-IOV admin channel 2026-04-02 18:05:05 -07:00
vnic_dev.h enic: Replace hardcoded values for vnic descriptor by defines 2024-04-25 10:36:30 +01:00
vnic_devcmd.h enic: enic rq extended cq defines 2025-03-11 10:21:15 +01:00
vnic_enet.h enic: get max rq & wq entries supported by hw, 16K queues 2025-03-11 10:21:38 +01:00
vnic_intr.c enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_intr.h enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_nic.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
vnic_resource.h enic: extend resource discovery for SR-IOV admin channel 2026-04-02 18:05:05 -07:00
vnic_rq.c enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_rq.h enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_rss.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
vnic_stats.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
vnic_vic.c enic: Avoid false positive under FORTIFY_SOURCE 2024-02-19 10:57:27 +00:00
vnic_vic.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00
vnic_wq.c enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
vnic_wq.h enic: add type-aware alloc for WQ, RQ, CQ and INTR resources 2026-04-02 18:05:06 -07:00
wq_enet_desc.h treewide: Replace GPLv2 boilerplate/reference with SPDX - gpl-2.0_168.RULE (part 1) 2022-06-10 14:51:36 +02:00