[PATCH net-next 1/4] net: pse-pd: unlink the controller before freeing its PI data
flat view
WARM1d
From: Carlo Szelinsky <hidden>
Date: 2026-10-18 08:19:19
Also in:
lkml
Subsystem:
networking drivers, pse network driver, the rest · Maintainers:
Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Oleksij Rempel, Kory Maincent, Linus Torvalds
pse_controller_unregister() frees the PI array before it takes the controller off pse_controller_list. In that window of_pse_control_get() can still find the controller and read the freed array, and so can pse_isr() and the notification worker. Disable the IRQ, take the controller off the list and stop the worker first. Only then free the PI data. Signed-off-by: Carlo Szelinsky <redacted> --- drivers/net/pse-pd/pse_core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/net/pse-pd/pse_core.c b/drivers/net/pse-pd/pse_core.c
index a5e6d7b26b9f..364acc025097 100644
--- a/drivers/net/pse-pd/pse_core.c
+++ b/drivers/net/pse-pd/pse_core.c@@ -1114,15 +1114,19 @@ EXPORT_SYMBOL_GPL(pse_controller_register); */ void pse_controller_unregister(struct pse_controller_dev *pcdev) { - pse_flush_pw_ds(pcdev); - pse_release_pis(pcdev); + /* Stop the IRQ, new lookups and the worker before freeing pcdev->pi. */ if (pcdev->irq) disable_irq(pcdev->irq); - cancel_work_sync(&pcdev->ntf_work); - kfifo_free(&pcdev->ntf_fifo); + mutex_lock(&pse_list_mutex); list_del(&pcdev->list); mutex_unlock(&pse_list_mutex); + + cancel_work_sync(&pcdev->ntf_work); + + pse_flush_pw_ds(pcdev); + pse_release_pis(pcdev); + kfifo_free(&pcdev->ntf_fifo); } EXPORT_SYMBOL_GPL(pse_controller_unregister);
--
2.43.0