[PATCH net v2] net: wan: fsl_ucc_hdlc: release HDLC device on remove

[PATCH net v2] net: wan: fsl_ucc_hdlc: release HDLC device on remove

[Myeonghun Pak]

ucc_hdlc_probe() registers an HDLC netdev whose private pointer refers to
the separately allocated ucc_hdlc_private object. The remove path frees
that private object without unregistering or freeing the netdev, leaving
a registered device with a dangling private pointer.

Unregister and free the HDLC device before releasing its private object.
An active device must be closed before detach_hdlc_protocol(), because
the detach path resets dev->flags and clears IFF_UP. Otherwise the later
unregister_netdevice() skips ndo_stop, leaving NAPI, the UCC and its IRQ
active while their backing resources are freed.

Close the device inside unregister_hdlc_device() while RTNL is held and
the HDLC protocol is still attached. This lets uhdlc_close() disable NAPI,
stop the UCC and free the IRQ before the remove path releases the DMA and
private resources.

Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC")
Cc: stable@vger.kernel.org
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
---
Changes in v2:
- Close an active HDLC device before detaching its protocol so ndo_stop
  performs the NAPI, UCC and IRQ teardown noted by Simon Horman's review.
- Link to v1: https://lore.kernel.org/netdev/20260728171545.49247-1-mhun512@gmail.com/

 drivers/net/wan/fsl_ucc_hdlc.c | 3 +++
 drivers/net/wan/hdlc.c         | 1 +
 2 files changed, 4 insertions(+)

diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c
index 809f21fb93..4c843c94cf 100644
--- a/drivers/net/wan/fsl_ucc_hdlc.c
+++ b/drivers/net/wan/fsl_ucc_hdlc.c
@@ -1255,6 +1255,8 @@ static void ucc_hdlc_remove(struct platform_device *pdev)
 {
 	struct ucc_hdlc_private *priv = dev_get_drvdata(&pdev->dev);
 
+	unregister_hdlc_device(priv->ndev);
+
 	uhdlc_memclean(priv);
 
 	if (priv->utdm && priv->utdm->si_regs) {
@@ -1266,6 +1268,7 @@ static void ucc_hdlc_remove(struct platform_device *pdev)
 		iounmap(priv->utdm->siram);
 		priv->utdm->siram = NULL;
 	}
+	free_netdev(priv->ndev);
 	kfree(priv);
 
 	dev_info(&pdev->dev, "UCC based hdlc module removed\n");
diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
index cbed10b1d8..a38f90d300 100644
--- a/drivers/net/wan/hdlc.c
+++ b/drivers/net/wan/hdlc.c
@@ -263,6 +263,7 @@ EXPORT_SYMBOL(alloc_hdlcdev);
 void unregister_hdlc_device(struct net_device *dev)
 {
 	rtnl_lock();
+	dev_close(dev);
 	detach_hdlc_protocol(dev);
 	unregister_netdevice(dev);
 	rtnl_unlock();
-- 
2.47.1