On 25.07.2025 15:50:41, Jimmy Assarsson wrote:

quoted

quoted

@@ -1876,6 +1883,8 @@ static void kvaser_pciefd_remove(struct pci_dev *pdev)
  	for (i = 0; i < pcie->nr_channels; ++i)
  		free_candev(pcie->can[i]->can.dev);
+	devlink_unregister(priv_to_devlink(pcie));
+	devlink_free(priv_to_devlink(pcie));
  	pci_iounmap(pdev, pcie->reg_base);

                           ^^^^

This smells like a use after free. Please call the cleanup function in
reverse order of allocation functions, i.e. move devlink_free() to the
end of this function.

quoted

  	pci_release_regions(pdev);
  	pci_disable_device(pdev);

I agree. Thanks for finding this!
I've tested moving devlink_free() to the end of the function, without any
issues.

Thanks.

If you don't find any other problems, do you mind making this change before sending
the PR? Otherwise I need to wait for the netdev 24h grace period, as Paolo
pointed out [1], before sending v5.

No problem. I've fixed the patch while applying the whole series to
can-next and including it in my PR. Thanks for your big contribution!

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |