[PATCH net] net: fm10k: shut down the service timer during removal

[PATCH net] net: fm10k: shut down the service timer during removal

[Runyu Xiao]

The fm10k service timer rearms itself from its callback. During PCI
removal, timer_delete_sync() waits for a running callback but does not
prevent a callback or another service path from rearming the timer. This
can leave the timer referencing the fm10k_intfc after free_netdev().

Use timer_shutdown_sync() to permanently prevent rearming before teardown
continues.

The issue was identified by code inspection. No runtime reproduction or
trace demonstrating the failure is available.

The patch was not tested on real hardware. No hardware- or
firmware-specific runtime result is available. Validation used source
review and available build or emulation checks.

Fixes: 54b3c9cfad6b ("fm10k: start service timer on probe")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
index f5b4d0627..836664cfd 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
@@ -2245,7 +2245,7 @@ static void fm10k_remove(struct pci_dev *pdev)
 	struct fm10k_intfc *interface = pci_get_drvdata(pdev);
 	struct net_device *netdev = interface->netdev;
 
-	timer_delete_sync(&interface->service_timer);
+	timer_shutdown_sync(&interface->service_timer);
 
 	fm10k_stop_service_event(interface);
 	fm10k_stop_macvlan_task(interface);
-- 
2.34.1

RE: [PATCH net] net: fm10k: shut down the service timer during removal

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Runyu Xiao <runyu.xiao@seu.edu.cn>
> Sent: Sunday, October 4, 2026 1:44 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>
> Cc: Keller, Jacob E <jacob.e.keller@intel.com>; Vick, Matthew
> <matthew.vick@intel.com>; Andrew Lunn <andrew+netdev@lunn.ch>; David S
> . Miller <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>;
> Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>;
> intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; stable@vger.kernel.org; Runyu Xiao
> <runyu.xiao@seu.edu.cn>; Jianhao Xu <jianhao.xu@seu.edu.cn>
> Subject: [PATCH net] net: fm10k: shut down the service timer during
> removal
> 
> The fm10k service timer rearms itself from its callback. During PCI
> removal, timer_delete_sync() waits for a running callback but does not
> prevent a callback or another service path from rearming the timer.
> This can leave the timer referencing the fm10k_intfc after
> free_netdev().
> 
> Use timer_shutdown_sync() to permanently prevent rearming before
> teardown continues.
> 
> The issue was identified by code inspection. No runtime reproduction
> or trace demonstrating the failure is available.
> 
> The patch was not tested on real hardware. No hardware- or firmware-
> specific runtime result is available. Validation used source review
> and available build or emulation checks.
> 
> Fixes: 54b3c9cfad6b ("fm10k: start service timer on probe")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> index f5b4d0627..836664cfd 100644
> --- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> +++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> @@ -2245,7 +2245,7 @@ static void fm10k_remove(struct pci_dev *pdev)
>  	struct fm10k_intfc *interface = pci_get_drvdata(pdev);
>  	struct net_device *netdev = interface->netdev;
> 
> -	timer_delete_sync(&interface->service_timer);
> +	timer_shutdown_sync(&interface->service_timer);
> 
>  	fm10k_stop_service_event(interface);
>  	fm10k_stop_macvlan_task(interface);
> --
> 2.34.1


Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Re: [PATCH net] net: fm10k: shut down the service timer during removal

[Jacob Keller]

On 10/4/2026 4:43 AM, Runyu Xiao wrote:
> The fm10k service timer rearms itself from its callback. During PCI
> removal, timer_delete_sync() waits for a running callback but does not
> prevent a callback or another service path from rearming the timer. This
> can leave the timer referencing the fm10k_intfc after free_netdev().
> 
> Use timer_shutdown_sync() to permanently prevent rearming before teardown
> continues.
> 
> The issue was identified by code inspection. No runtime reproduction or
> trace demonstrating the failure is available.
> 
> The patch was not tested on real hardware. No hardware- or
> firmware-specific runtime result is available. Validation used source
> review and available build or emulation checks.
> 
> Fixes: 54b3c9cfad6b ("fm10k: start service timer on probe")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>  drivers/net/ethernet/intel/fm10k/fm10k_pci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> index f5b4d0627..836664cfd 100644
> --- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> +++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c
> @@ -2245,7 +2245,7 @@ static void fm10k_remove(struct pci_dev *pdev)
>  	struct fm10k_intfc *interface = pci_get_drvdata(pdev);
>  	struct net_device *netdev = interface->netdev;
>  
> -	timer_delete_sync(&interface->service_timer);
> +	timer_shutdown_sync(&interface->service_timer);
>  

I don't think I have access to hardware to test this anymore :\, but...

Acked-by: Jacob Keller <jacob.e.keller@intel.com>

>  	fm10k_stop_service_event(interface);
>  	fm10k_stop_macvlan_task(interface);