From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Pavel Andrianov <andrianov@ispras.ru>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 01/10] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
Date: Mon, 29 Mar 2021 18:23:52 -0400 [thread overview]
Message-ID: <20210329222401.2383930-1-sashal@kernel.org> (raw)
From: Pavel Andrianov <andrianov@ispras.ru>
[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]
pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 5d5000c8edf1..09cb0ac701e1 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1571,8 +1571,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
mdiobus_unregister(pep->smi_bus);
mdiobus_free(pep->smi_bus);
- unregister_netdev(dev);
cancel_work_sync(&pep->tx_timeout_task);
+ unregister_netdev(dev);
free_netdev(dev);
return 0;
}
--
2.30.1
next reply other threads:[~2021-03-29 22:31 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-29 22:23 Sasha Levin [this message]
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 02/10] mISDN: fix crash in fritzpci Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 03/10] mac80211: fix double free in ibss_leave Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 04/10] mac80211: choose first enabled channel for monitor Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 05/10] drm/msm: Ratelimit invalid-fence message Sasha Levin
2021-03-29 22:23 ` Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 06/10] x86/build: Turn off -fcf-protection for realmode targets Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 07/10] scsi: target: pscsi: Clean up after failure in pscsi_map_sg() Sasha Levin
2021-03-29 22:23 ` [PATCH AUTOSEL 4.9 08/10] ia64: mca: allocate early mca with GFP_ATOMIC Sasha Levin
2021-03-29 22:23 ` Sasha Levin
2021-03-29 22:24 ` [PATCH AUTOSEL 4.9 09/10] cifs: revalidate mapping when we open files for SMB1 POSIX Sasha Levin
2021-03-29 22:24 ` [PATCH AUTOSEL 4.9 10/10] cifs: Silently ignore unknown oplock break handle Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210329222401.2383930-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=andrianov@ispras.ru \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.