Re: [PATCH] net: ethernet: arc: fix use-after-free in probe error path
From: Andrew Lunn <andrew@lunn.ch>
Date: 2026-03-04 22:29:21
Also in:
linux-arm-kernel, linux-rockchip, stable
On Wed, Mar 04, 2026 at 02:53:03AM +0000, Fan Wu wrote:
The arc_emac_probe() function calls devm_request_irq() with the net_device as the dev_id. However, in the error path of emac_rockchip_probe(), free_netdev(ndev) is called before the devm cleanup happens. This creates a race window where an interrupt can fire and the ISR (arc_emac_intr) will access the already freed net_device structure.
It looks like interrupts are only enabled in arc_emac_open(). Have you
seen interrupts before this?
Andrew