e1000-race-window.patch — controlled-window amplifier for the
e1000 remove()/reset_task TOCTOU bug report.

Timing-only, gated by e1000.race_ctrl (default OFF = pristine code
path).  Usage: apply on Linux 7.3 with `patch -p1 <`, build a KASAN
kernel, boot a VM with an (QEMU) e1000 NIC, then in the guest:

  echo 1 > /sys/module/e1000/parameters/race_ctrl
  ip link set eth0 up; ip addr add 10.0.2.15/24 dev eth0
  ping -i 0.3 10.0.2.2 &        # traffic; drop the NIC link to arm watchdog
  echo <bdf> > /sys/bus/pci/drivers/e1000/unbind
  # ~1 s later: KASAN slab-use-after-free in e1000_reinit_locked
  # (race_ctrl=0 over the same choreography = negative control)

The archived evidence quoted in the report (three KASAN reports with
alloc/free/work stacks, and the race_ctrl=0 negative control) was
produced with the same two window-widening edits this patch
reconstructs.
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -195,6 +195,11 @@
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
+/* VERIFICATION ONLY: widen natural timing windows for observation */
+static bool race_ctrl;
+module_param(race_ctrl, bool, 0600);
+MODULE_PARM_DESC(race_ctrl, "verification: widen RESETTING/remove windows");
+
 /**
  * e1000_get_hw_dev - helper function for getting netdev
  * @hw: pointer to HW struct
@@ -533,6 +538,12 @@
 	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
 		msleep(1);
 
+	/* VERIFICATION ONLY (race_ctrl): widen [RESETTING set, clear] to 1s. */
+	if (race_ctrl) {
+		pr_info("E1000RACE: RESETTING set; widening [set, clear] to 1s, handshake with remove\n");
+		msleep(1000);
+	}
+
 	/* only run the task if not already down */
 	if (!test_bit(__E1000_DOWN, &adapter->flags)) {
 		e1000_down(adapter);
@@ -1261,6 +1272,16 @@
 
 	unregister_netdev(netdev);
 
+	/* VERIFICATION ONLY (race_ctrl): park before the racy test_bit,
+	 * dispatch the real reset_task, wait for RESETTING so test_bit
+	 * reads true and cancel_work_sync() is skipped (the audited race). */
+	if (race_ctrl) {
+		pr_info("E1000RACE: remove parked before test_bit; dispatching reset_task and waiting for RESETTING\n");
+		schedule_work(&adapter->reset_task);
+		while (!test_bit(__E1000_RESETTING, &adapter->flags))
+			msleep(10);
+	}
+
 	/* Only kill reset task if adapter is not resetting */
 	if (!test_bit(__E1000_RESETTING, &adapter->flags))
 		cancel_work_sync(&adapter->reset_task);