On Thu, Nov 12, 2026 at 2:41 AM Jakub Kicinski [off-list ref] wrote:
On Mon, 9 Nov 2026 23:30:06 -0500 Myeonghun Pak wrote:
quoted
mhi_mbim_remove() cancels rx_refill before wwan_unregister_ops()
removes the links. Bringing a link up in between calls mhi_mbim_ndo_open()
and queues the work again. With the MHI channels already reset, the
work cannot refill RX buffers and keeps re-arming itself, eventually
running after devres frees the context.
Use disable_delayed_work_sync() to drain the work and reject later
queueing. Probe initializes fresh work on rebind.
Found by a static analysis tool under development.
Fixes: aa730a9905b7 ("net: wwan: Add MHI MBIM network driver")
Cc: <redacted> # v6.10+
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>
---
diff --git a/drivers/net/wwan/mhi_wwan_mbim.c b/drivers/net/wwan/mhi_wwan_mbim.c
index 336f89756f10..3b6b0066f673 100644
--- a/drivers/net/wwan/mhi_wwan_mbim.c
+++ b/drivers/net/wwan/mhi_wwan_mbim.c
@@ -650,7 +650,7 @@ static void mhi_mbim_remove(struct mhi_device *mhi_dev)
struct mhi_controller *cntrl = mhi_dev->mhi_cntrl;
mhi_unprepare_from_transfer(mhi_dev);
- cancel_delayed_work_sync(&mbim->rx_refill);
+ disable_delayed_work_sync(&mbim->rx_refill);
wwan_unregister_ops(&cntrl->mhi_dev->dev);
kfree_skb(mbim->skbagg_head);
dev_set_drvdata(&mhi_dev->dev, NULL);
AI says this is not enough for make the teardown correct:
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261110043006.56681-1-mhun512@gmail.com
Indeed, thank you.
Myeonghun, could you move the disable_delayed_work_sync() call to the
appropriate location, as described in the link above?
Thanks,
Loic