[PATCH] net: stmmac: stop DMA before freeing descriptors on open

[PATCH] net: stmmac: stop DMA before freeing descriptors on open

[ZhaoJinming]

In __stmmac_open() and stmmac_xdp_open(), the DMA engine is started
before stmmac_request_irq() is called.  If the IRQ request fails, the
clean-up paths free the DMA descriptor rings via dma_free_coherent()
without stopping the DMA engine first.

With the DMA engine still running, hardware may continue to access the
descriptor ring memory after it has been freed.  Add stmmac_stop_all_dma()
to both error paths, matching the teardown order in __stmmac_release().

Fixes: 8532f613bc78b ("net: stmmac: introduce MSI Interrupt routines for mac, safety, RX & TX")
Signed-off-by: ZhaoJinming <zhaojinming@uniontech.com>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index b2b7d0242dd3..f76d762c314c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -4176,6 +4176,8 @@ static int __stmmac_open(struct net_device *dev,
 irq_error:
 	phylink_stop(priv->phylink);
 
+	stmmac_stop_all_dma(priv);
+
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
 
@@ -7203,6 +7205,8 @@ int stmmac_xdp_open(struct net_device *dev)
 	return 0;
 
 irq_error:
+	stmmac_stop_all_dma(priv);
+
 	for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++)
 		hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer);
 
-- 
2.51.0

Re: [PATCH] net: stmmac: stop DMA before freeing descriptors on open

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu, 27 Aug 2026 10:54:15 +0800 you wrote:
> In __stmmac_open() and stmmac_xdp_open(), the DMA engine is started
> before stmmac_request_irq() is called.  If the IRQ request fails, the
> clean-up paths free the DMA descriptor rings via dma_free_coherent()
> without stopping the DMA engine first.
> 
> With the DMA engine still running, hardware may continue to access the
> descriptor ring memory after it has been freed.  Add stmmac_stop_all_dma()
> to both error paths, matching the teardown order in __stmmac_release().
> 
> [...]

Here is the summary with links:
  - net: stmmac: stop DMA before freeing descriptors on open
    https://git.kernel.org/netdev/net-next/c/25c1f6111034

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html