From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Pavel Andrianov <andrianov@ispras.ru>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 06/23] net: pxa168_eth: Fix a potential data race in pxa168_eth_remove
Date: Fri, 9 Apr 2021 11:53:36 +0200 [thread overview]
Message-ID: <20210409095303.107903042@linuxfoundation.org> (raw)
In-Reply-To: <20210409095302.894568462@linuxfoundation.org>
From: Pavel Andrianov <andrianov@ispras.ru>
[ Upstream commit 0571a753cb07982cc82f4a5115e0b321da89e1f3 ]
pxa168_eth_remove() firstly calls unregister_netdev(),
then cancels a timeout work. unregister_netdev() shuts down a device
interface and removes it from the kernel tables. If the timeout occurs
in parallel, the timeout work (pxa168_eth_tx_timeout_task) performs stop
and open of the device. It may lead to an inconsistent state and memory
leaks.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Pavel Andrianov <andrianov@ispras.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/pxa168_eth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c
index 51b77c2de400..235bbb2940a8 100644
--- a/drivers/net/ethernet/marvell/pxa168_eth.c
+++ b/drivers/net/ethernet/marvell/pxa168_eth.c
@@ -1554,8 +1554,8 @@ static int pxa168_eth_remove(struct platform_device *pdev)
mdiobus_unregister(pep->smi_bus);
mdiobus_free(pep->smi_bus);
- unregister_netdev(dev);
cancel_work_sync(&pep->tx_timeout_task);
+ unregister_netdev(dev);
free_netdev(dev);
return 0;
}
--
2.30.2
next prev parent reply other threads:[~2021-04-09 10:03 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-09 9:53 [PATCH 5.4 00/23] 5.4.111-rc1 review Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 01/23] ARM: dts: am33xx: add aliases for mmc interfaces Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 02/23] bus: ti-sysc: Fix warning on unbind if reset is not deasserted Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 03/23] platform/x86: intel-hid: Support Lenovo ThinkPad X1 Tablet Gen 2 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 04/23] bpf, x86: Use kvmalloc_array instead kmalloc_array in bpf_jit_comp Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 05/23] net/mlx5e: Enforce minimum value check for ICOSQ size Greg Kroah-Hartman
2021-04-09 9:53 ` Greg Kroah-Hartman [this message]
2021-04-09 9:53 ` [PATCH 5.4 07/23] mISDN: fix crash in fritzpci Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 08/23] mac80211: choose first enabled channel for monitor Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 09/23] drm/msm/adreno: a5xx_power: Dont apply A540 lm_setup to other GPUs Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 10/23] drm/msm: Ratelimit invalid-fence message Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 11/23] netfilter: conntrack: Fix gre tunneling over ipv6 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 12/23] platform/x86: thinkpad_acpi: Allow the FnLock LED to change state Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 13/23] x86/build: Turn off -fcf-protection for realmode targets Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 14/23] scsi: target: pscsi: Clean up after failure in pscsi_map_sg() Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 15/23] ia64: mca: allocate early mca with GFP_ATOMIC Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 16/23] ia64: fix format strings for err_inject Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 17/23] cifs: revalidate mapping when we open files for SMB1 POSIX Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 18/23] cifs: Silently ignore unknown oplock break handle Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 19/23] bpf, x86: Validate computation of branch displacements for x86-64 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 20/23] bpf, x86: Validate computation of branch displacements for x86-32 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 21/23] nvme-mpath: replace direct_make_request with generic_make_request Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 22/23] init/Kconfig: make COMPILE_TEST depend on !S390 Greg Kroah-Hartman
2021-04-09 9:53 ` [PATCH 5.4 23/23] init/Kconfig: make COMPILE_TEST depend on HAS_IOMEM Greg Kroah-Hartman
2021-04-09 19:22 ` [PATCH 5.4 00/23] 5.4.111-rc1 review Florian Fainelli
2021-04-09 20:14 ` Guenter Roeck
2021-04-09 20:39 ` Shuah Khan
2021-04-09 21:20 ` Sudip Mukherjee
2021-04-10 0:55 ` Samuel Zou
2021-04-10 7:27 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210409095303.107903042@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=andrianov@ispras.ru \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.