[PATCH net v2 0/2] net: fec: fix PTP clock teardown races on device removal
From: Shengzhuo Wei <hidden>
Date: 2026-09-08 02:38:09
Also in:
imx, lkml, stable
This series fixes two FEC teardown races: ethtool can access a freed PTP clock, and the PPS interrupt can outlive the PHC and netdev. I have kept the main Ethernet IRQ issue discussed with Phuc [1] out of this revision. His PTP initialization error-propagation changes are also separate; if they land first, the new probe failure path will need PPS IRQ cleanup too. Full x86_64 kernel and module builds passed with W=1, FEC=m and PTP enabled and disabled. The bugs were found by code inspection; no hardware testing was done. [1] https://lore.kernel.org/r/CAABR9nHLcR103aADF1WMSEkw-_BjWB9vyWXENJCYfjX5Wz1nkw@mail.gmail.com/ (local) --- Link to v1: https://lore.kernel.org/netdev/20260904-fec-ptp-pps-event-uaf-v1-0-9af446be4a11@cherr.cc (local) Changes in v2: - Drop the ptp_clock_index_by_dev() lookup and unregister the netdev before fec_ptp_stop() instead, as suggested by Wei Fang, so the netdev callbacks are drained before the PHC teardown. - Use -1 as the "no PPS interrupt" sentinel so a valid IRQ 0 is neither skipped on release nor freed when the request never happened. --- Shengzhuo Wei (2): net: fec: stop the PTP clock after the netdev is unregistered net: fec: free the PPS interrupt before tearing down the PHC and netdev drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_main.c | 2 +- drivers/net/ethernet/freescale/fec_ptp.c | 12 +++++++++++- 3 files changed, 13 insertions(+), 2 deletions(-) --- base-commit: 548e7bcd0c5460ddcbca9600cea603ebeebf4da7 change-id: 20260901-fec-ptp-pps-event-uaf-dcc71b5e1db0 Best regards, -- Shengzhuo Wei [off-list ref]