> -----Original Message-----
> From: Pavan Kumar Linga <pavan.kumar.linga@xxxxxxxxx>
> Sent: Friday, October 25, 2024 11:39 AM
> To: intel-wired-lan@xxxxxxxxxxxxxxxx
> Cc: netdev@xxxxxxxxxxxxxxx; horms@xxxxxxxxxx; Linga, Pavan Kumar
> <pavan.kumar.linga@xxxxxxxxx>; stable@xxxxxxxxxxxxxxx; Singh, Tarun K
> <tarun.k.singh@xxxxxxxxx>
> Subject: [PATCH iwl-net v2 2/2] idpf: fix idpf_vc_core_init error path
>
> In an event where the platform running the device control plane
> is rebooted, reset is detected on the driver. It releases
> all the resources and waits for the reset to complete. Once the
> reset is done, it tries to build the resources back. At this
> time if the device control plane is not yet started, then
> the driver timeouts on the virtchnl message and retries to
> establish the mailbox again.
>
> In the retry flow, mailbox is deinitialized but the mailbox
> workqueue is still alive and polling for the mailbox message.
> This results in accessing the released control queue leading to
> null-ptr-deref. Fix it by unrolling the work queue cancellation
> and mailbox deinitialization in the reverse order which they got
> initialized.
>
> Fixes: 4930fbf419a7 ("idpf: add core init and interrupt request")
> Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
> Cc: stable@xxxxxxxxxxxxxxx # 6.9+
> Reviewed-by: Tarun K Singh <tarun.k.singh@xxxxxxxxx>
> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@xxxxxxxxx>
> ---
> v2:
> - remove changes which are not fixes for the actual issue from this patch
> ---
> drivers/net/ethernet/intel/idpf/idpf_lib.c | 1 +
> drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 1 -
> 2 files changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> index c3848e10e7db..b4fbb99bfad2 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
Tested-by: Krishneil Singh <krishneil.k.singh@xxxxxxxxx>
