github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-24 06:24:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: sgi: ioc3-eth: unregister netdev before freeing DMA rings

Browse Source 
ioc3eth_remove() frees the coherent RX and TX descriptor rings before
unregistering the netdev. If the interface is running,
unregister_netdev() invokes ioc3_close() through ndo_stop.

ioc3_close() stops the device and then calls ioc3_free_rx_bufs() and
ioc3_clean_tx_ring(). Both cleanup functions access descriptors in the
rings, so the current ordering causes CPU accesses to freed coherent
memory. Until ioc3_stop() disables RX and TX DMA, the device may also
continue using the freed ring addresses.

Unregister the netdev before releasing the rings. This lets the core
close a running interface and quiesce the device while the rings are
still valid. Keep the explicit timer deletion because ndo_stop is not
called when the interface is already down.

Cc: <stable+noautosel@kernel.org> # untested fix for ancient HW
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Reviewed-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://patch.msgid.link/40CD736C4911C181+20260629085053.964383-1-raoxu@uniontech.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xu Rao 2026-06-29 16:50:53 +08:00 committed by Jakub Kicinski
parent 317cefdcaa
commit 18a28f3e10
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/ethernet/sgi/ioc3-eth.c
View File

@ -967,11 +967,12 @@ static void ioc3eth_remove(struct platform_device *pdev)
struct net_device *dev = platform_get_drvdata(pdev);
struct ioc3_private *ip = netdev_priv(dev);
unregister_netdev(dev);
timer_delete_sync(&ip->ioc3_timer);
dma_free_coherent(ip->dma_dev, RX_RING_SIZE, ip->rxr, ip->rxr_dma);
dma_free_coherent(ip->dma_dev, TX_RING_SIZE + SZ_16K - 1, ip->tx_ring, ip->txr_dma);
unregister_netdev(dev);
timer_delete_sync(&ip->ioc3_timer);
free_netdev(dev);
}