On Tue, Nov 10, 2026 at 5:30 AM Myeonghun Pak [off-list ref] wrote:
mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.
Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.
Found by a static analysis tool under development.
Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: <redacted> # v6.10+
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
quoted hunk ↗ jump to hunk
---
diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index 336f89756f10..3b6b0066f673 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c
@@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
mhi_unprepare_from_transfer(mhi_dev);
- cancel_delayed_work_sync(&mbim->rx_refill);
+ disable_delayed_work_sync(&mbim->rx_refill);
wwan_unregister_ops(&cntrl->mhi_dev->dev);
kfree_skb(mbim->skbagg_head);
dev_set_drvdata(&mhi_dev->dev, NULL);
base-commit: 0edbc945eb9edd0086f25b151a79cfe4adc0dfa8
--
2.43.0