* [PATCH net] net: rionet: clear peer->res after releasing the outbound doorbell
@ 2026-11-04 9:48 Thomas Fourier
0 siblings, 0 replies; only message in thread
From: Thomas Fourier @ 2026-11-04 9:48 UTC (permalink / raw)
Cc: Thomas Fourier, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Alexandre Bounine, Andrew Morton,
open list:NETWORKING DRIVERS, open list
rionet_close() releases peer->res with rio_release_outb_dbell(), but
leaves peer->res set. rionet_remove_dev() can releases peer->res again.
Clear peer->res once it has been released.
This bug was found statically and is theoretical.
Fixes: 34ed2ebb65b0 ("rapidio/rionet: add locking into add/remove device")
Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
---
drivers/net/rionet.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 64b5d0a8ae4a..f8a7a778f283 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -387,8 +387,10 @@ static int rionet_close(struct net_device *ndev)
rio_send_doorbell(peer->rdev, RIONET_DOORBELL_LEAVE);
nets[netid].active[peer->rdev->destid] = NULL;
}
- if (peer->res)
+ if (peer->res) {
rio_release_outb_dbell(peer->rdev, peer->res);
+ peer->res = NULL;
+ }
}
spin_unlock_irqrestore(&nets[netid].lock, flags);
--
2.53.0
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-11-04 9:50 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-04 9:48 [PATCH net] net: rionet: clear peer->res after releasing the outbound doorbell Thomas Fourier
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox