[PATCH net] net/mlx4: shut down catas recovery timer during teardown

[PATCH net] net/mlx4: shut down catas recovery timer during teardown

[Runyu Xiao]

The catas error timer can rearm itself while the device is being
stopped. If poll_catas() is running when timer_delete_sync() drops the
timer-base lock, it can call mod_timer() after the deletion. The delete
can then return with the timer queued again, allowing a subsequent callback
to access teardown-owned MMIO state after it has been unmapped.

On PFs, poll_catas() accesses catas_err.map; on VFs, it accesses the
mapped communication channel. Use timer_shutdown_sync() to prevent the
callback from rearming the timer once teardown starts.

mlx4_start_catas_poll() calls timer_setup() when device registration is
restarted after reload or port reconfiguration, so the timer is
reinitialized before it is used again.

The change was validated by source review and a target-object build.
Runtime validation on mlx4 hardware was not available.

Fixes: ee49bd9397cd ("mlx4_core: Reset device when internal error is detected")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
---
 drivers/net/ethernet/mellanox/mlx4/catas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c
index edcc6f662..62574b790 100644
--- a/drivers/net/ethernet/mellanox/mlx4/catas.c
+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
@@ -305,7 +305,7 @@ void mlx4_stop_catas_poll(struct mlx4_dev *dev)
 {
 	struct mlx4_priv *priv = mlx4_priv(dev);
 
-	timer_delete_sync(&priv->catas_err.timer);
+	timer_shutdown_sync(&priv->catas_err.timer);
 
 	if (priv->catas_err.map) {
 		iounmap(priv->catas_err.map);
-- 
2.34.1

Re: [PATCH net] net/mlx4: shut down catas recovery timer during teardown

[Tariq Toukan]

On 04/10/2026 15:12, Runyu Xiao wrote:
> The catas error timer can rearm itself while the device is being
> stopped. If poll_catas() is running when timer_delete_sync() drops the
> timer-base lock, it can call mod_timer() after the deletion. The delete
> can then return with the timer queued again, allowing a subsequent callback
> to access teardown-owned MMIO state after it has been unmapped.
> 
> On PFs, poll_catas() accesses catas_err.map; on VFs, it accesses the
> mapped communication channel. Use timer_shutdown_sync() to prevent the
> callback from rearming the timer once teardown starts.
> 
> mlx4_start_catas_poll() calls timer_setup() when device registration is
> restarted after reload or port reconfiguration, so the timer is
> reinitialized before it is used again.
> 
> The change was validated by source review and a target-object build.
> Runtime validation on mlx4 hardware was not available.
> 
> Fixes: ee49bd9397cd ("mlx4_core: Reset device when internal error is detected")

This is fixing a patch from 2007.

Did you hit this issue in reality, or just claimed by an AI tool?

We need to have a very good justification to touch this old piece of 
code now, especially in stable.

> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
> ---
>   drivers/net/ethernet/mellanox/mlx4/catas.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c
> index edcc6f662..62574b790 100644
> --- a/drivers/net/ethernet/mellanox/mlx4/catas.c
> +++ b/drivers/net/ethernet/mellanox/mlx4/catas.c
> @@ -305,7 +305,7 @@ void mlx4_stop_catas_poll(struct mlx4_dev *dev)
>   {
>   	struct mlx4_priv *priv = mlx4_priv(dev);
>   
> -	timer_delete_sync(&priv->catas_err.timer);
> +	timer_shutdown_sync(&priv->catas_err.timer);
>   
>   	if (priv->catas_err.map) {
>   		iounmap(priv->catas_err.map);