Re: [PATCH net v3 3/3] net: pse-pd: unregister from the controller list before freeing PI data

On 8/13/26 22:06, Carlo Szelinsky wrote:

pse_controller_unregister() frees the PI array with pse_release_pis()
while the controller is still linked on pse_controller_list, and only
removes it from the list afterwards. A concurrent consumer probe running
of_pse_control_get() walks that list under pse_list_mutex and calls
of_pse_match_pi(), which dereferences pcdev->pi[i].np. If the walk lands
on a controller that is being torn down, it reads the freed (with the
previous patch, NULLed) PI array.

Move the list_del() ahead of pse_release_pis(). Both the lookup and the
removal serialise on pse_list_mutex, so once the controller is unlinked
no new lookup can reach it, and any lookup already in progress holds the
mutex and has matched against a live pi before the free can run. No NULL
checks are needed on the lookup path.

Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
Signed-off-by: Carlo Szelinsky <redacted>

Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>

Thank you!
-- 
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com