[PATCH 1/2] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

[PATCH 1/2] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

[Ayush Mukkanwar]

The TX cleanup tasklet can be scheduled by the watchdog IRQ handler
to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in
the queue which might run after the cvm_oct_remove() frees net_device
structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it
iterates cvm_oct_device[] which is an array of netdevice pointers.
Add tasklet_kill() after free_irq() to ensure the tasklet is no longer
scheduled or running before teardown proceeds.

Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
---
 drivers/staging/octeon/ethernet-tx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
index 14d10659bce7..785c6492f170 100644
--- a/drivers/staging/octeon/ethernet-tx.c
+++ b/drivers/staging/octeon/ethernet-tx.c
@@ -668,4 +668,6 @@ void cvm_oct_tx_shutdown(void)
 {
 	/* Free the interrupt handler */
 	free_irq(OCTEON_IRQ_TIMER1, cvm_oct_device);
+
+	tasklet_kill(&cvm_oct_tx_cleanup_tasklet);
 }
-- 
2.54.0

[PATCH 2/2] staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown

[Ayush Mukkanwar]

cvm_oct_rx_shutdown calls free_irq and netif_napi_del without
disabling the napi instance first. As the free_irq only waits
for completion of hard interrupt handlers, the napi poll
function could still be active. If cvm_oct_remove proceeds to
free the plat structure (which holds the NAPI instances), the
active poll function will access freed memory, resulting in a
use-after-free crash.

Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
---
 drivers/staging/octeon/ethernet-rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/staging/octeon/ethernet-rx.c b/drivers/staging/octeon/ethernet-rx.c
index cd36b5ba6f6c..3e9d58d32156 100644
--- a/drivers/staging/octeon/ethernet-rx.c
+++ b/drivers/staging/octeon/ethernet-rx.c
@@ -535,6 +535,8 @@ void cvm_oct_rx_shutdown(struct platform_device *pdev)
 		else
 			cvmx_write_csr(CVMX_POW_WQ_INT_THRX(i), 0);
 
+		napi_disable(&plat->rx_group[i].napi);
+
 		/* Free the interrupt handler */
 		free_irq(plat->rx_group[i].irq, &plat->rx_group[i].napi);
 
-- 
2.54.0

Re: [PATCH 1/2] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

[Dan Carpenter]

On Sun, Jun 14, 2026 at 05:17:38PM +0530, Ayush Mukkanwar wrote:
> The TX cleanup tasklet can be scheduled by the watchdog IRQ handler
> to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in
> the queue which might run after the cvm_oct_remove() frees net_device
> structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it
> iterates cvm_oct_device[] which is an array of netdevice pointers.
> Add tasklet_kill() after free_irq() to ensure the tasklet is no longer
> scheduled or running before teardown proceeds.
> 
> Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
> ---

Looks good.  A couple process though.

1. It needs a Fixes tags.

2. You need to say when you are using AI.  I think you're supposed to
say which AI tool you are using as well.

3. You need to say that the patch has not been tested.

regards,
dan carpenter

Re: [PATCH 1/2] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

[Ayush Mukkanwar]

Thanks for the feedback, Dan.
Sashiko found these existing bugs in the octeon driver when it
reviewed my older patches on octeon.
I will include the required details in the next version of the patch.

On Mon, Jun 15, 2026 at 1:48 PM Dan Carpenter <error27@gmail.com> wrote:
>
> On Sun, Jun 14, 2026 at 05:17:38PM +0530, Ayush Mukkanwar wrote:
> > The TX cleanup tasklet can be scheduled by the watchdog IRQ handler
> > to execute cvm_oct_tx_do_cleanup. There can be a pending tasklet in
> > the queue which might run after the cvm_oct_remove() frees net_device
> > structures, causing a use-after-free in cvm_oct_tx_do_cleanup() as it
> > iterates cvm_oct_device[] which is an array of netdevice pointers.
> > Add tasklet_kill() after free_irq() to ensure the tasklet is no longer
> > scheduled or running before teardown proceeds.
> >
> > Signed-off-by: Ayush Mukkanwar <ayushmukkanwar@gmail.com>
> > ---
>
> Looks good.  A couple process though.
>
> 1. It needs a Fixes tags.
>
> 2. You need to say when you are using AI.  I think you're supposed to
> say which AI tool you are using as well.
>
> 3. You need to say that the patch has not been tested.
>
> regards,
> dan carpenter
>

Re: [PATCH 1/2] staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown

[Dan Carpenter]

On Mon, Jun 15, 2026 at 02:38:53PM +0530, Ayush Mukkanwar wrote:
> Thanks for the feedback, Dan.
> Sashiko found these existing bugs in the octeon driver when it
> reviewed my older patches on octeon.
> I will include the required details in the next version of the patch.

Thanks, this is really useful information.  In that case, you need
a Reported-by tag an a link to the Sashiko report.

regards,
dan carpenter