github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 05:04:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

Browse Source 
cvm_oct_rx_shutdown calls free_irq and netif_napi_del without
disabling the napi instance first. As the free_irq only waits
for completion of hard interrupt handlers, the napi poll
function could still be active. If cvm_oct_remove proceeds to
free the plat structure (which holds the NAPI instances), the
active poll function will access freed memory, resulting in a
use-after-free crash.

Fixes: 3368c784bc ("Staging: Octeon Ethernet: Convert to NAPI.")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260511150931.93382-1-ayushmukkanwar%40gmail.com
Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
Link: https://patch.msgid.link/20260615172734.42038-2-ayushmukkanwar@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ayush Mukkanwar 2026-06-15 22:57:34 +05:30 committed by Greg Kroah-Hartman
parent b9af44b0d2
commit c0a9a8586a
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/staging/octeon/ethernet-rx.c
View File

@ -535,6 +535,8 @@ void cvm_oct_rx_shutdown(struct platform_device *pdev)
else
cvmx_write_csr(CVMX_POW_WQ_INT_THRX(i), 0);
napi_disable(&plat->rx_group[i].napi);
/* Free the interrupt handler */
free_irq(plat->rx_group[i].irq, &plat->rx_group[i].napi);