net: wwan: mhi_wwan_mbim: disable rx_refill work on removal

mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: <redacted> # v6.10+
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>

---

diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index 336f89756f10..3b6b0066f673 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c

@@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
 	struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
 
 	mhi_unprepare_from_transfer(mhi_dev);
-	cancel_delayed_work_sync(&mbim->rx_refill);
+	disable_delayed_work_sync(&mbim->rx_refill);
 	wwan_unregister_ops(&cntrl->mhi_dev->dev);
 	kfree_skb(mbim->skbagg_head);
 	dev_set_drvdata(&mhi_dev->dev, NULL);

base-commit: 0edbc945eb9edd0086f25b151a79cfe4adc0dfa8
-- 
2.43.0

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

On Tue, Nov 10, 2026 at 5:30 AM Myeonghun Pak [off-list ref] wrote:

mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: <redacted> # v6.10+
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>

Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>

On Mon,  9 Nov 2026 23:30:06 -0500 Myeonghun Pak wrote:

AI says this is not enough for make the teardown correct:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261110043006.56681-1-mhun512@gmail.com
-- 
pw-bot: cr

On Thu, Nov 12, 2026 at 2:41 AM Jakub Kicinski [off-list ref] wrote:

On Mon,  9 Nov 2026 23:30:06 -0500 Myeonghun Pak wrote:

quoted

mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.

Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.

Found by a static analysis tool under development.

Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: <redacted> # v6.10+
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>

---

diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index 336f89756f10..3b6b0066f673 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c

@@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
      struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;

      mhi_unprepare_from_transfer(mhi_dev);
-     cancel_delayed_work_sync(&mbim->rx_refill);
+     disable_delayed_work_sync(&mbim->rx_refill);
      wwan_unregister_ops(&cntrl->mhi_dev->dev);
      kfree_skb(mbim->skbagg_head);
      dev_set_drvdata(&mhi_dev->dev, NULL);

AI says this is not enough for make the teardown correct:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261110043006.56681-1-mhun512@gmail.com

Indeed, thank you.

Myeonghun, could you move the disable_delayed_work_sync() call to the
appropriate location, as described in the link above?

Thanks,
Loic