From 25c1f6111034aef7fc06cfbdcf1e4f0d6e5ee74b Mon Sep 17 00:00:00 2001 From: ZhaoJinming Date: Thu, 27 Aug 2026 10:54:15 +0800 Subject: [PATCH] net: stmmac: stop DMA before freeing descriptors on open In __stmmac_open() and stmmac_xdp_open(), the DMA engine is started before stmmac_request_irq() is called. If the IRQ request fails, the clean-up paths free the DMA descriptor rings via dma_free_coherent() without stopping the DMA engine first. With the DMA engine still running, hardware may continue to access the descriptor ring memory after it has been freed. Add stmmac_stop_all_dma() to both error paths, matching the teardown order in __stmmac_release(). Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Signed-off-by: ZhaoJinming Link: https://patch.msgid.link/32EB352EB66D74E7+20260827025415.2684733-1-zhaojinming@uniontech.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index f2fc89176654..66ae365e1c89 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4177,6 +4177,8 @@ static int __stmmac_open(struct net_device *dev, irq_error: phylink_stop(priv->phylink); + stmmac_stop_all_dma(priv); + for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer); @@ -7187,6 +7189,8 @@ int stmmac_xdp_open(struct net_device *dev) return 0; irq_error: + stmmac_stop_all_dma(priv); + for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);