From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Pavel Andrianov <andrianov@ispras.ru>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 02/14] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
Date: Fri, 9 Apr 2021 11:53:27 +0200 [thread overview]
Message-ID: <20210409095300.473246196@linuxfoundation.org> (raw)
In-Reply-To: <20210409095300.391558233@linuxfoundation.org>
From: Pavel Andrianov <andrianov@ispras.ru>
[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]
pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 993724959a7c..1883f0d076e3 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1553,8 +1553,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
mdiobus_unregister(pep->smi_bus);
mdiobus_free(pep->smi_bus);
- unregister_netdev(dev);
cancel_work_sync(&pep->tx_timeout_task);
+ unregister_netdev(dev);
free_netdev(dev);
return 0;
}
--
2.30.2
next prev parent reply other threads:[~2021-04-09 9:57 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-09 9:53 [PATCH 4.14 00/14] 4.14.230-rc1 review Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 01/14] ARM: dts: am33xx: add aliases for mmc interfaces Greg Kroah-Hartman
2021-04-09 9:53 ` Greg Kroah-Hartman [this message]
2021-04-09 9:53 ` [PATCH 4.14 03/14] mISDN: fix crash in fritzpci Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 04/14] mac80211: choose first enabled channel for monitor Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 05/14] drm/msm: Ratelimit invalid-fence message Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 06/14] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 07/14] x86/build: Turn off -fcf-protection for realmode targets Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 08/14] scsi: target: pscsi: Clean up after failure in pscsi_map_sg() Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 09/14] ia64: mca: allocate early mca with GFP_ATOMIC Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 10/14] cifs: revalidate mapping when we open files for SMB1 POSIX Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 11/14] cifs: Silently ignore unknown oplock break handle Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 12/14] bpf, x86: Validate computation of branch displacements for x86-64 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 13/14] init/Kconfig: make COMPILE_TEST depend on !S390 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 4.14 14/14] init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM Greg Kroah-Hartman
2021-04-09 20:13 ` [PATCH 4.14 00/14] 4.14.230-rc1 review Guenter Roeck
2021-04-10 4:53 ` Guenter Roeck
2021-04-10 9:21 ` Naresh Kamboju
2021-04-10 15:46 ` Guenter Roeck
2021-04-10 13:15 ` Greg Kroah-Hartman
2021-04-10 15:01 ` Guenter Roeck
2021-04-10 9:19 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210409095300.473246196@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andrianov@ispras.ru \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.