> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Larysa Zaremba
> Sent: Monday, March 23, 2026 6:41 PM
> To: intel-wired-lan@lists.osuosl.org; Nguyen, Anthony L
> <anthony.l.nguyen@intel.com>
> Cc: Lobakin, Aleksander <aleksander.lobakin@intel.com>; Samudrala,
> Sridhar <sridhar.samudrala@intel.com>; Singhai, Anjali
> <anjali.singhai@intel.com>; Michal Swiatkowski
> <michal.swiatkowski@linux.intel.com>; Zaremba, Larysa
> <larysa.zaremba@intel.com>; Fijalkowski, Maciej
> <maciej.fijalkowski@intel.com>; Tantilov, Emil S
> <emil.s.tantilov@intel.com>; Chittim, Madhu <madhu.chittim@intel.com>;
> Hay, Joshua A <joshua.a.hay@intel.com>; Keller, Jacob E
> <jacob.e.keller@intel.com>; Shanmugam, Jayaprakash
> <jayaprakash.shanmugam@intel.com>; Jiri Pirko <jiri@resnulli.us>;
> David S. Miller <davem@davemloft.net>; Eric Dumazet
> <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni
> <pabeni@redhat.com>; Simon Horman <horms@kernel.org>; Jonathan Corbet
> <corbet@lwn.net>; Richard Cochran <richardcochran@gmail.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Andrew Lunn
> <andrew+netdev@lunn.ch>; netdev@vger.kernel.org; linux-
> doc@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: [Intel-wired-lan] [PATCH iwl-next v6 09/14] idpf: make
> mbx_task queueing and cancelling more consistent
>
> As a consequence of refactoring idpf code to use libeth APIs,
> idpf_vc_xn_shutdown was merged with and replaced by
> idpf_deinit_dflt_mbx.
> This does not affect the Tx path, as it checked for a presence of an
> xn manager anyway. Rx processing is handled by the mbx_task that is
> not always cancelled before calling the new consolidated mailbox
> deinit function.
> Moreover, in the reset path idpf_intr_rel() reschedules it after the
> deinit is done. This leads to mbx_task referencing the freed mailbox
> and causing KASAN warnings.
>
> To remedy this, in the init path, do the first queueing of mbx_task in
> idpf_init_dflt_mbx(), in deinit and reset, always cancel the task in
> idpf_deinit_dflt_mbx() and in every flow first call
> idpf_mb_intr_rel_irq().
>
> Reviewed-by: Emil Tantilov <emil.s.tantilov@intel.com>
> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
> Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
> Tested-by: Samuel Salin <Samuel.salin@intel.com>
> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
> ---
> drivers/net/ethernet/intel/idpf/idpf.h | 1 +
> drivers/net/ethernet/intel/idpf/idpf_lib.c | 9 ++++-----
> drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 6 +++++-
> 3 files changed, 10 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf.h
> b/drivers/net/ethernet/intel/idpf/idpf.h
> index b06640925fb9..9606c0de018f 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf.h
> +++ b/drivers/net/ethernet/intel/idpf/idpf.h
> @@ -984,6 +984,7 @@ void idpf_vc_event_task(struct work_struct *work);
> void idpf_dev_ops_init(struct idpf_adapter *adapter); void
> idpf_vf_dev_ops_init(struct idpf_adapter *adapter); int
> idpf_intr_req(struct idpf_adapter *adapter);
> +void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter);
> void idpf_intr_rel(struct idpf_adapter *adapter);
> u16 idpf_get_max_tx_hdr_size(struct idpf_adapter *adapter); int
> idpf_initiate_soft_reset(struct idpf_vport *vport, diff --git
> a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> index 0d131bf0993e..7988836fbae0 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> @@ -68,9 +68,11 @@ static void idpf_deinit_vector_stack(struct
> idpf_adapter *adapter)
> * This will also disable interrupt mode and queue up mailbox task.
> Mailbox
> * task will reschedule itself if not in interrupt mode.
> */
> -static void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter)
> +void idpf_mb_intr_rel_irq(struct idpf_adapter *adapter)
> {
> - clear_bit(IDPF_MB_INTR_MODE, adapter->flags);
> + if (!test_and_clear_bit(IDPF_MB_INTR_MODE, adapter->flags))
> + return;
> +
> kfree(free_irq(adapter->msix_entries[0].vector, adapter));
> queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0); }
> @@ -1938,14 +1940,11 @@ static void idpf_init_hard_reset(struct
> idpf_adapter *adapter)
> goto unlock_mutex;
> }
>
> - queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0);
> -
> /* Initialize the state machine, also allocate memory and
> request
> * resources
> */
> err = idpf_vc_core_init(adapter);
> if (err) {
> - cancel_delayed_work_sync(&adapter->mbx_task);
> idpf_deinit_dflt_mbx(adapter);
> goto unlock_mutex;
> }
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index 6d847aea00e4..38d119147ab6 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -2974,6 +2974,8 @@ int idpf_init_dflt_mbx(struct idpf_adapter
> *adapter)
> adapter->xnm = params.xnm;
> adapter->state = __IDPF_VER_CHECK;
>
> + queue_delayed_work(adapter->mbx_wq, &adapter->mbx_task, 0);
> +
> return 0;
> }
>
> @@ -2983,6 +2985,9 @@ int idpf_init_dflt_mbx(struct idpf_adapter
> *adapter)
> */
> void idpf_deinit_dflt_mbx(struct idpf_adapter *adapter) {
> + idpf_mb_intr_rel_irq(adapter);
> + cancel_delayed_work_sync(&adapter->mbx_task);
> +
> if (adapter->arq && adapter->asq) {
> idpf_mb_clean(adapter, adapter->asq, true);
> libie_ctlq_xn_deinit(adapter->xnm, &adapter->ctlq_ctx);
> @@ -3237,7 +3242,6 @@ void idpf_vc_core_deinit(struct idpf_adapter
> *adapter)
> idpf_deinit_dflt_mbx(adapter);
>
> cancel_delayed_work_sync(&adapter->serv_task);
> - cancel_delayed_work_sync(&adapter->mbx_task);
>
> idpf_vport_params_buf_rel(adapter);
>
> --
> 2.47.0
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>