[PATCH net v2 1/2] net: spacemit: Fix TX timeout work deadlocking on itself

[Muhammad Bilal]

Traced the paths: the work and every emac_stop() caller serialize on
RTNL, the stale-work case is covered by the !netif_running() check,
and disable_work_sync() before rtnl_lock() in suspend avoids waiting
on the work while holding the lock. Looks correct to me.

Nit: please add "Cc: stable at vger.kernel.org", the Fixes: commit is
already released.

Reviewed-by: Muhammad Bilal <meatuni001 at gmail.com>

On Fri, Nov 13, 2026 at 6:28 PM Ali Tariq <alitariq45892 at gmail.com> wrote:
>
> emac_tx_timeout_task() takes RTNL and calls dev_close(), which ends up
> waiting for the work itself. The function call hierarchy is as follows
>
> emac_tx_timeout_task()
>     dev_close()
>       emac_stop()
>         emac_down()
>           cancel_work_sync(&priv->tx_timeout_task)
>
> The work never finishes and keeps RTNL held, so after a TX timeout
> everything that needs RTNL hangs.
>
> Remove cancel_work_sync() from emac_down(). Disable the work in
> emac_suspend() instead, and enable it again in emac_resume(). emac_remove()
> runs before the devm-managed unregister_netdev(), so use
> disable_work_sync() there to stop the work from being queued again.
>
> Found by code inspection. Not reproduced on hardware. Tested on Orange
> Pi RV2 (SpacemiT K1) with suspend/resume cycles and kselftest, with
> lockdep enabled.
>
> Fixes: bfec6d7f2001 ("net: spacemit: Add K1 Ethernet MAC")
> Reported-by: Troy Mitchell <troy.mitchell at linux.spacemit.com>
> Closes: https://lore.kernel.org/all/DMO74K2MG3D7.15UUOU1O66K6N@linux.spacemit.com/
> Suggested-by: Vivian Wang <wangruikang at iscas.ac.cn>
> Signed-off-by: Ali Tariq <alitariq45892 at gmail.com>
> ---
>  drivers/net/ethernet/spacemit/k1_emac.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/spacemit/k1_emac.c b/drivers/net/ethernet/spacemit/k1_emac.c
> index 71a80838bffd..51edc95f54c8 100644
> --- a/drivers/net/ethernet/spacemit/k1_emac.c
> +++ b/drivers/net/ethernet/spacemit/k1_emac.c
> @@ -1732,7 +1732,6 @@ static int emac_down(struct emac_priv *priv)
>         napi_disable(&priv->napi);
>
>         timer_delete_sync(&priv->txtimer);
> -       cancel_work_sync(&priv->tx_timeout_task);
>
>         timer_delete_sync(&priv->stats_timer);
>
> @@ -2010,8 +2009,9 @@ static void emac_remove(struct platform_device *pdev)
>  {
>         struct emac_priv *priv = platform_get_drvdata(pdev);
>
> +       disable_work_sync(&priv->tx_timeout_task);
> +
>         timer_shutdown_sync(&priv->txtimer);
> -       cancel_work_sync(&priv->tx_timeout_task);
>
>         timer_shutdown_sync(&priv->stats_timer);
>
> @@ -2024,6 +2024,8 @@ static int emac_resume(struct device *dev)
>         struct net_device *ndev = priv->ndev;
>         int ret;
>
> +       enable_work(&priv->tx_timeout_task);
> +
>         ret = clk_prepare_enable(priv->bus_clk);
>         if (ret < 0) {
>                 dev_err(dev, "Failed to enable bus clock: %d\n", ret);
> @@ -2051,6 +2053,8 @@ static int emac_suspend(struct device *dev)
>         struct emac_priv *priv = dev_get_drvdata(dev);
>         struct net_device *ndev = priv->ndev;
>
> +       disable_work_sync(&priv->tx_timeout_task);
> +
>         if (!ndev || !netif_running(ndev)) {
>                 clk_disable_unprepare(priv->bus_clk);
>                 return 0;
> --
> 2.34.1
>