atl1_reset_dev_task is scheduled from the interrupt handler on PCIe
PHY link down and DMA read/write errors, and link_chg_task can be
pending from link events. atl1_remove() tears down and frees the
net_device without cancelling either work, so a work scheduled just
before unregister_netdev() can run after free_netdev() and touch the
freed adapter.

Cancel both works before unregistering the net_device, as atl2_remove()
already does for its reset and link works.

Fixes: f3cc28c79760 ("Add Attansic L1 ethernet driver.")
Cc: stable@vger.kernel.org
Assisted-by: GLM:5.3
Signed-off-by: Shengzhuo Wei <me@cherr.cc>
---
Remove-side work cancellation, matching what atl2_remove() already
does for its reset and link works: the IRQ handler schedules
reset_dev_task on PCIe PHY link down and DMA errors, and link events
schedule link_chg_task, but atl1_remove() frees the net_device without
cancelling either work.
---
Changes in v2:
- Point Fixes at the initial driver commit instead of the 2012 rename
  commit; both works and the cancel-less remove go back to the
  original import (Breno Leitao).
- Link to v1: https://patch.msgid.link/20260828-atl1-cancel-reset-work-v1-1-9a2140dab074@cherr.cc
---
 drivers/net/ethernet/atheros/atlx/atl1.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
index 98a4d089270e..b49353a94f5e 100644
--- a/drivers/net/ethernet/atheros/atlx/atl1.c
+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
@@ -3128,6 +3128,9 @@ static void atl1_remove(struct pci_dev *pdev)
 
 	adapter = netdev_priv(netdev);
 
+	cancel_work_sync(&adapter->reset_dev_task);
+	cancel_work_sync(&adapter->link_chg_task);
+
 	/*
 	 * Some atl1 boards lack persistent storage for their MAC, and get it
 	 * from the BIOS during POST.  If we've been messing with the MAC

---
base-commit: 45c13f3f9e3bb15fd89ff2864c6f627a3b4b4229
change-id: 20260827-atl1-cancel-reset-work-54fe8746c623

Best regards,
--  
Shengzhuo Wei <me@cherr.cc>

On Fri, 28 Aug 2026 18:14:58 +0800 Shengzhuo Wei wrote:
> atl1_reset_dev_task is scheduled from the interrupt handler on PCIe
> PHY link down and DMA read/write errors, and link_chg_task can be
> pending from link events. atl1_remove() tears down and frees the
> net_device without cancelling either work, so a work scheduled just
> before unregister_netdev() can run after free_netdev() and touch the
> freed adapter.
> 
> Cancel both works before unregistering the net_device, as atl2_remove()
> already does for its reset and link works.

This is not enough to fully fix the issue, please leave this driver
alone.
-- 
pw-bot: reject
pv-bot: slop