The interrupt handler schedules a tasklet which accesses the device queues.
tasklet_disable() waits for a running instance, but leaves a scheduled
instance pending while he_stop() releases those queues and the device.

After masking device interrupts, unregister the IRQ so the handler can no
longer schedule the tasklet, then kill the tasklet before releasing any of
its data.

The affected driver was removed upstream by commit 6deb53595092 ("net:
remove unused ATM protocols and legacy ATM device drivers").  This change
is intended for maintained stable kernels which still carry the driver.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/atm/he.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index 92a041d..6b2c795 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -1536,9 +1536,13 @@ he_stop(struct he_dev *he_dev)
 		pci_read_config_dword(pci_dev, GEN_CNTL_0, &gen_cntl_0);
 		gen_cntl_0 &= ~(INT_PROC_ENBL | INIT_ENB);
 		pci_write_config_dword(pci_dev, GEN_CNTL_0, gen_cntl_0);
+	}
 
-		tasklet_disable(&he_dev->tasklet);
+	if (he_dev->irq)
+		free_irq(he_dev->irq, he_dev);
+	tasklet_kill(&he_dev->tasklet);
 
+	if (he_dev->membase) {
 		/* disable recv and transmit */
 
 		reg = he_readl_mbox(he_dev, CS_ERCTL0);
@@ -1555,9 +1559,6 @@ he_stop(struct he_dev *he_dev)
 		he_dev->atm_dev->phy->stop(he_dev->atm_dev);
 #endif /* CONFIG_ATM_HE_USE_SUNI */
 
-	if (he_dev->irq)
-		free_irq(he_dev->irq, he_dev);
-
 	if (he_dev->irq_base)
 		dma_free_coherent(&he_dev->pci_dev->dev, (CONFIG_IRQ_SIZE + 1)
 				  * sizeof(struct he_irq), he_dev->irq_base, he_dev->irq_phys);
-- 
2.50.1.windows.1

On Fri, Jul 24, 2026 at 01:27:10PM +0800, Hongyan Xu wrote:
> The interrupt handler schedules a tasklet which accesses the device queues.
> tasklet_disable() waits for a running instance, but leaves a scheduled
> instance pending while he_stop() releases those queues and the device.
> 
> After masking device interrupts, unregister the IRQ so the handler can no
> longer schedule the tasklet, then kill the tasklet before releasing any of
> its data.
> 
> The affected driver was removed upstream by commit 6deb53595092 ("net:
> remove unused ATM protocols and legacy ATM device drivers").  This change
> is intended for maintained stable kernels which still carry the driver.

Why don't we just delete the driver instead as obviously no one uses
this.  Unless you have the hardware to test these changes?

thanks,

greg k-h