atl1_reset_dev_task is scheduled from the interrupt handler on PCIe
PHY link down and DMA read/write errors, and link_chg_task can be
pending from link events. atl1_remove() tears down and frees the
net_device without cancelling either work, so a work scheduled just
before unregister_netdev() can run after free_netdev() and touch the
freed adapter.

Cancel both works before unregistering the net_device, as atl2_remove()
already does for its reset and link works.

Fixes: 03662e41c7cf ("atl1: fix kernel panic in case of DMA errors")
Cc: stable@vger.kernel.org
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
Remove-side work cancellation, matching what atl2_remove() already
does for its reset and link works: the IRQ handler schedules
reset_dev_task on PCIe PHY link down and DMA errors, and link events
schedule link_chg_task, but atl1_remove() frees the net_device without
cancelling either work.
---
 drivers/net/ethernet/atheros/atlx/atl1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
index 98a4d089270e..b49353a94f5e 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
@@ -3128,6 +3128,9 @@ static void atl1_remove(struct pci_dev *pdev)
 
 	adapter = netdev_priv(netdev);
 
+	cancel_work_sync(&adapter->reset_dev_task);
+	cancel_work_sync(&adapter->link_chg_task);
+
 	/*
 	 * Some atl1 boards lack persistent storage for their MAC, and get it
 	 * from the BIOS during POST.  If we've been messing with the MAC

---
base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
change-id: 20260827-atl1-cancel-reset-work-54fe8746c623

Best regards,
--  
Shengzhuo Wei <me@cherr.cc>

On Fri, Aug 28, 2026 at 03:48:55PM +0800, Shengzhuo Wei wrote:
> atl1_reset_dev_task is scheduled from the interrupt handler on PCIe
> PHY link down and DMA read/write errors, and link_chg_task can be
> pending from link events. atl1_remove() tears down and frees the
> net_device without cancelling either work, so a work scheduled just
> before unregister_netdev() can run after free_netdev() and touch the
> freed adapter.
> 
> Cancel both works before unregistering the net_device, as atl2_remove()
> already does for its reset and link works.
> 
> Fixes: 03662e41c7cf ("atl1: fix kernel panic in case of DMA errors")

Is 03662e41c7cf the right commit to blame?

Both works, and the unregister_netdev()/free_netdev() sequence with no
cancel, came in with the initial driver in f3cc28c79760 ("Add Attansic
L1 ethernet driver."), no?

On 2026-08-28 02:49, Breno Leitao wrote:
 
> Is 03662e41c7cf the right commit to blame?
> 
> Both works, and the unregister_netdev()/free_netdev() sequence with no
> cancel, came in with the initial driver in f3cc28c79760 ("Add Attansic
> L1 ethernet driver."), no?

You are right, thanks.  03662e41c7cf only renamed tx_timeout_task to
reset_dev_task; the link_chg_task, and the remove path with no
cancellation of either work, are already in the initial import.
v2 points Fixes at f3cc28c79760.

--
Shengzhuo Wei