[PATCH net 0/3] net: ethernet: disable async work before teardown

[BeaCox <0xbeac@gmail.com>]

Three Ethernet drivers free the netdev while an asynchronously queued
work item can still dereference it.  The queue sites and the handlers
differ, but the lifetime rule is the same: stop the producer, drain the
work, then free the object.

Patch 1 fixes atl1.  reset_dev_task is queued from the interrupt handler
for link-down and DMA errors and from ndo_tx_timeout(); link_chg_task is
queued from the interrupt handler when ISR_GPHY reports a link event.
Both works are disabled and the PHY configuration timer is deleted
before unregister_netdev().

Patch 2 fixes enc28j60.  tx_work is queued from ndo_start_xmit(),
setrx_work from ndo_set_rx_mode(), and restart_work from ndo_tx_timeout().
The interface is unregistered first, then the three works are disabled
before free_irq() and free_netdev().

Patch 3 fixes xgmac.  tx_timeout_work is queued from ndo_tx_timeout()
and from the DMA error interrupt.  The work starts disabled in probe,
is enabled by xgmac_open()/xgmac_resume(), disabled in xgmac_stop()
before the DMA rings are freed and in xgmac_suspend() before NAPI and
interrupts are torn down, and disabled in xgmac_remove() before the
IRQs and MMIO are released.  The patch does not reorder the existing
free_irq()/unregister_netdev() calls in xgmac_remove().

The works are disabled with disable_work_sync() rather than cancelled:
it drains a pending or running instance and also rejects later
queue_work() calls from interrupts or timers that are still in flight.
This API was added in v6.10, so the stable tag is 6.10+; older trees
need the cancel_work_sync() form of the same change.

The three patches are independent and can be applied separately.  They
are grouped only because they fix the same teardown pattern.

Testing: the in-tree driver code was run under KASAN on QEMU/KVM (x86-64,
2 vCPUs).  A SCHED_FIFO task on one CPU queues the work and keeps the
per-CPU system workqueue from running while a second CPU unbinds the
device; the vulnerable kernels report a slab-use-after-free in
assign_work() and the fixed kernels complete with the work still
pending at remove entry.  The three patched drivers also build as
modules with W=1.  There is no physical hardware in the test setup: the
platform/SPI teardown paths are exercised with test devices, and the
atl1 probe path is not exercised.

BeaCox (3):
  net: atl1: disable work before freeing the netdev
  net: enc28j60: disable work before freeing the netdev
  net: xgmac: disable timeout work before teardown

 drivers/net/ethernet/atheros/atlx/atl1.c  | 12 +++++++++
 drivers/net/ethernet/calxeda/xgmac.c      | 30 +++++++++++++++++++++++
 drivers/net/ethernet/microchip/enc28j60.c |  9 +++++++
 3 files changed, 51 insertions(+)

-- 
2.43.0