[PATCH net 1/3] net: fealnx: fix teardown order in remove
From: Жамбакиев Радий Рикардинович <hidden>
Date: 2026-09-24 10:44:30
Also in:
lkml, stable
Subsystem:
networking drivers, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
From: Radiy Zhambakiev <redacted>
fealnx_remove_one() frees the DMA rings before unregistering the
netdev, while the interface may still be up, which leaves a
window where freed memory can be accessed.
Call unregister_netdev() first so dev_close() stops the Tx/Rx
engines, deletes the timers, and frees the IRQ before the rings are
freed. While at it use dev_err() instead of printk() for the
unknown-device case.
Found by Linux Verification Center (linuxtesting.org)
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <redacted>
---
drivers/net/ethernet/fealnx.c | 29 ++++++++++++++++-------------
1 file changed, 16 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index bdc38aac5850..d7cd1644a375 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c@@ -678,20 +678,23 @@ static int fealnx_init_one(struct pci_dev *pdev, static void fealnx_remove_one(struct pci_dev *pdev) { struct net_device *dev = pci_get_drvdata(pdev); + struct netdev_private *np; + + if (!dev) { + dev_err(&pdev->dev, "remove for unknown device\n"); + return; + } + + np = netdev_priv(dev); - if (dev) { - struct netdev_private *np = netdev_priv(dev); - - dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring, - np->tx_ring_dma); - dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring, - np->rx_ring_dma); - unregister_netdev(dev); - pci_iounmap(pdev, np->mem); - free_netdev(dev); - pci_release_regions(pdev); - } else - printk(KERN_ERR "fealnx: remove for unknown device\n"); + unregister_netdev(dev); + dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring, + np->tx_ring_dma); + dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring, + np->rx_ring_dma); + pci_iounmap(pdev, np->mem); + pci_release_regions(pdev); + free_netdev(dev); }
--
2.53.0