RE: [PATCH net v2 1/3] net: fealnx: fix teardown order in remove

-----Original Message-----
From: Жамбакиев Радий Рикардинович <redacted>
Sent: Friday, October 2, 2026 4:10 PM
To: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: Жамбакиев Радий Рикардинович <redacted>;
David S. Miller [off-list ref]; Eric Dumazet
[off-list ref]; Jakub Kicinski [off-list ref]; Paolo Abeni
[off-list ref]; Michael Grzeschik [off-list ref]; Jijie Shao
[off-list ref]; Loktionov, Aleksandr
[off-list ref]; Denis Benato
[off-list ref]; Uwe Kleine-König (The Capable Hub)
[off-list ref]; netdev@vger.kernel.org; linux-
kernel@vger.kernel.org; lvc-project@linuxtesting.org;
stable@vger.kernel.org
Subject: [PATCH net v2 1/3] net: fealnx: fix teardown order in remove

From: Radiy Zhambakiev <redacted>

fealnx_remove_one() frees the DMA rings before unregistering the
netdev, while the interface may still be up, which leaves a window
where freed memory can be accessed.

Call unregister_netdev() first so dev_close() stops the Tx/Rx engines,
deletes the timers, and frees the IRQ before the rings are freed.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <redacted>
---
 drivers/net/ethernet/fealnx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/fealnx.c

b/drivers/net/ethernet/fealnx.c index bdc38aac5850..68194c9ef332
100644

--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c

@@ -682,11 +682,11 @@ static void fealnx_remove_one(struct pci_dev

*pdev)
 	if (dev) {
 		struct netdev_private *np = netdev_priv(dev);

+		unregister_netdev(dev);
 		dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np-

quoted

tx_ring,

 				  np->tx_ring_dma);
 		dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np-

quoted

rx_ring,

 				  np->rx_ring_dma);
-		unregister_netdev(dev);
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
--
2.53.0