All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Pavel Andrianov <andrianov@ispras.ru>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 06/33] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
Date: Mon, 29 Mar 2021 18:21:54 -0400	[thread overview]
Message-ID: <20210329222222.2382987-6-sashal@kernel.org> (raw)
In-Reply-To: <20210329222222.2382987-1-sashal@kernel.org>

From: Pavel Andrianov <andrianov@ispras.ru>

[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]

pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index d1e4d42e497d..3712e1786091 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1544,8 +1544,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
 	clk_disable_unprepare(pep->clk);
 	mdiobus_unregister(pep->smi_bus);
 	mdiobus_free(pep->smi_bus);
-	unregister_netdev(dev);
 	cancel_work_sync(&pep->tx_timeout_task);
+	unregister_netdev(dev);
 	free_netdev(dev);
 	return 0;
 }
-- 
2.30.1


  parent reply	other threads:[~2021-03-29 22:24 UTC|newest]

Thread overview: 43+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-29 22:21 [PATCH AUTOSEL 5.10 01/33] ARM: dts: am33xx: add aliases for mmc interfaces Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 02/33] bus: ti-sysc: Fix warning on unbind if reset is not deasserted Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 03/33] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2 Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 04/33] bpf, x86: Use kvmalloc_array instead kmalloc_array in bpf_jit_comp Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 05/33] net/mlx5e: Enforce minimum value check for ICOSQ size Sasha Levin
2021-03-29 22:21 ` Sasha Levin [this message]
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 07/33] kunit: tool: Fix a python tuple typing error Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 08/33] mISDN: fix crash in fritzpci Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 09/33] net: correct sk_acceptq_is_full() Sasha Levin
2021-04-05 18:59   ` Marcelo Ricardo Leitner
2021-04-07 14:15     ` Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 10/33] mac80211: fix double free in ibss_leave Sasha Levin
2021-03-29 22:21 ` [PATCH AUTOSEL 5.10 11/33] mac80211: Check crypto_aead_encrypt for errors Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 12/33] mac80211: choose first enabled channel for monitor Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 13/33] drm/msm/dsi_pll_7nm: Fix variable usage for pll_lockdet_rate Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 14/33] drm/msm/adreno: a5xx_power: Don't apply A540 lm_setup to other GPUs Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 15/33] drm/msm: Ratelimit invalid-fence message Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 16/33] netfilter: conntrack: Fix gre tunneling over ipv6 Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 17/33] netfilter: nftables: skip hook overlap logic if flowtable is stale Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 18/33] net: ipa: fix init header command validation Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 19/33] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 20/33] kselftest/arm64: sve: Do not use non-canonical FFR register value Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 21/33] drm/msm/disp/dpu1: icc path needs to be set before dpu runtime resume Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 22/33] x86/build: Turn off -fcf-protection for realmode targets Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 23/33] block: clear GD_NEED_PART_SCAN later in bdev_disk_changed Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 24/33] platform/x86: intel_pmc_core: Ignore GBE LTR on Tiger Lake platforms Sasha Levin
2021-03-29 22:22   ` [Intel-wired-lan] " Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 25/33] ptp_qoriq: fix overflow in ptp_qoriq_adjfine() u64 calcalation Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 26/33] scsi: target: pscsi: Clean up after failure in pscsi_map_sg() Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 27/33] selftests/vm: fix out-of-tree build Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 28/33] ia64: mca: allocate early mca with GFP_ATOMIC Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 29/33] ia64: fix format strings for err_inject Sasha Levin
2021-03-29 22:22   ` Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 30/33] cifs: revalidate mapping when we open files for SMB1 POSIX Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 31/33] cifs: Silently ignore unknown oplock break handle Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 32/33] io_uring: fix timeout cancel return code Sasha Levin
2021-03-29 22:22 ` [PATCH AUTOSEL 5.10 33/33] math: Export mul_u64_u64_div_u64 Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210329222222.2382987-6-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=andrianov@ispras.ru \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.