From nobody Sat Sep 26 06:32:38 2026 Received: from sg-2-3.ptr.blmpb.com (sg-2-3.ptr.blmpb.com [71.18.227.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD535511210 for ; Thu, 3 Sep 2026 20:16:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788466576; cv=none; b=Gn5h4l8xQcFPxkub1JrSaaGzb3tiyawSyHLIyVBSJ4RJpsdbBxbHZfKjM83lMbdTUEem+PGmG5dJSN86S3bK0oJL6v4rKzqQOYzoPTg3bkgRR2UKlcdkFbSLvArkmFCGGp5cKtcbPo1ykuFx83Zy1BmkhXYzxG3sQOIMCilLfNE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788466576; c=relaxed/simple; bh=MnX38husahtb+5jlsjHaZHaRb+oO4cDjSxx1UtgTSJ0=; h=References:Date:Mime-Version:Content-Type:In-Reply-To:Cc:From: Subject:Message-Id:To; b=r9dfUwTMdAVQ5NzuM+fVueUYgXcepQB6geyl0BQNSbKPbX+dhuTlgu9q4XlewWggnHwET8P5hvLgHYbRbZcHWJpFizN72kHNDMgkvwMAXjqD0CazHrC8mB8eGe66x/4hjpXzBzeL6AORgcD04zfD+AjRDYNtKLlJiHoINxfIwPo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=f2Um+nh4; arc=none smtp.client-ip=71.18.227.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="f2Um+nh4" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788466553; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=ay+UdxR5B/j0GDEDWbydnqfmebpHc2uhIh4YQv8+mkU=; b=f2Um+nh4Wnby9Be3MeLdP6jOKt0z+euSfhstaS6G9IVDsVCTUftx3f56Fu7oxYmnhNrDiM LNkxgX/xb7HyGDhXwvbaw2NFRH6Uvlhogf67f3Iu8VY19gjGPWUmqvdWE4chNJWb5+5NAz sA+6lWO97f3u9WI6GJeawyOuHOS8UMJ1WKWmq4lnuTvJ3pGgmK3m/bmfsafZpRlGqneYoR qVjO8Wy/GDgdizdJVAGE9GkejnU5viFfhHytLHoYvWSeTbkRuyA7w66T6ABtvkU4xOvI3t U54u8X82RHySZmMjgfD29yBxGtLeE33dcyjUuVgkpH2HpfT5a9/A86C5k7Zeug== References: <20260904-fec-ptp-pps-event-uaf-v1-0-9af446be4a11@cherr.cc> Content-Transfer-Encoding: quoted-printable X-Lms-Return-Path: Date: Fri, 04 Sep 2026 04:15:45 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 In-Reply-To: <20260904-fec-ptp-pps-event-uaf-v1-0-9af446be4a11@cherr.cc> Cc: , , , , "Shengzhuo Wei" X-Original-From: Shengzhuo Wei Received: from [192.168.9.107] ([111.42.148.30]) by smtp.feishu.cn with ESMTPS; Fri, 04 Sep 2026 04:15:51 +0800 From: "Shengzhuo Wei" Subject: [PATCH net 1/2] net: fec: don't leave a stale PTP clock pointer after unregister Message-Id: <20260904-fec-ptp-pps-event-uaf-v1-1-9af446be4a11@cherr.cc> To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" , "Fugang Duan" X-Mailer: b4 0.16.0 Content-Type: text/plain; charset="utf-8" fec_drv_remove() calls fec_ptp_stop() before unregister_netdev(), and fec_ptp_stop() leaves fep->ptp_clock set after ptp_clock_unregister(). An ethtool -T issued while the netdev is still registered then reaches fec_enet_get_ts_info(), which passes the stale pointer to ptp_clock_index() after the clock structure has been freed. Query the PHC index through ptp_clock_index_by_dev() instead. The lookup holds a reference to the matching PTP class device while reading its index, so concurrent unregister cannot free it underneath the lookup. It returns -1 once no clock is registered. Clear fep->ptp_clock after unregistering it as well, so the driver state no longer retains the invalid pointer. Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fai= l path") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec_main.c | 3 +-- drivers/net/ethernet/freescale/fec_ptp.c | 4 +++- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethern= et/freescale/fec_main.c index 794ec427b0ee..0606559d495c 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3337,8 +3337,7 @@ static int fec_enet_get_ts_info(struct net_device *nd= ev, SOF_TIMESTAMPING_TX_HARDWARE | SOF_TIMESTAMPING_RX_HARDWARE | SOF_TIMESTAMPING_RAW_HARDWARE; - if (fep->ptp_clock) - info->phc_index =3D ptp_clock_index(fep->ptp_clock); + info->phc_index =3D ptp_clock_index_by_dev(&fep->pdev->dev); =20 info->tx_types =3D (1 << HWTSTAMP_TX_OFF) | (1 << HWTSTAMP_TX_ON); diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/etherne= t/freescale/fec_ptp.c index 56801c2009d5..0036549974fd 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -861,6 +861,8 @@ void fec_ptp_stop(struct platform_device *pdev) =20 cancel_delayed_work_sync(&fep->time_keep); hrtimer_cancel(&fep->perout_timer); - if (fep->ptp_clock) + if (fep->ptp_clock) { ptp_clock_unregister(fep->ptp_clock); + fep->ptp_clock =3D NULL; + } } --=20 2.47.3 From nobody Sat Sep 26 06:32:38 2026 Received: from sg-2-3.ptr.blmpb.com (sg-2-3.ptr.blmpb.com [71.18.227.3]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FED05111B4 for ; Thu, 3 Sep 2026 20:16:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.3 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788466580; cv=none; b=eeatrpQU4C2tpvuIqLZ+0RnftPAkyOKeq1Mm+Rt27eVx14Kjm3S76ri2r4ZHH2qt1a9B3M79BRg7xPfCYk0m6dRjkYXPbe6G6xBUPCZEtsvINahBSRsWvwFq8hvxu85Lfd+wew8fVQJVMZkQ+TfYIEuIqP6sbgb2325J/x/9EdQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788466580; c=relaxed/simple; bh=77M/velDp7X7l0MvBb4bkvo6NbiSoZE+zbFrKfeB8UI=; h=Content-Type:Date:References:In-Reply-To:From:To:Cc:Mime-Version: Subject:Message-Id; b=rrGPynit4LMs6278Ub1Eim6W1zXCZw8Ld01TLI/yJ+MidcEP9MkJ78Yr+PjeXGLwoFbJOOYO9no5i5QtuBG+p1A0xU4VYCG4UJU26L3qe1iOL+81TD8m9gywvCaeBR/2xwZTR+VMDKNJPvnxM6Y08iwba/w2d4OC4Wf9cgORjuc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=r5paMQA6; arc=none smtp.client-ip=71.18.227.3 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="r5paMQA6" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788466555; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=ldLrh1H+v+HY/oP7X4m3JBwZjgD1X/VmJUpYnEeKWmo=; b=r5paMQA6eu2cL89pd8I4ySqItuvupzR/B/CacjvNpztDHwJUEVz3fOmshzZ3khENWZVIpp JRepyNlPzWjhgAKHZOzGMow1nOXEpgxE1c6nzEIeQHwLkkNFY9mM0ExZrkdi8qTQFuK0Nu Ve2TChn/UPe0MTMsHcWYvB00u8X+UC7CnkWFzM0O9ML2AUjSRc4Xk5caokf/drlUrCP5Dl RhpaAR99fpRyAxAM7U2Bf8AX6tEBXPGCVGahG8SBICkbyBrQH+lixLsag+ui3AU413czCY 7MR//1l9vGvmL0F+Ct/bQq5wb1DqJIrESxzFnqXY5HNstfHl5hm4gWEKcsqiEw== X-Original-From: Shengzhuo Wei Date: Fri, 04 Sep 2026 04:15:46 +0800 References: <20260904-fec-ptp-pps-event-uaf-v1-0-9af446be4a11@cherr.cc> X-Mailer: b4 0.16.0 In-Reply-To: <20260904-fec-ptp-pps-event-uaf-v1-0-9af446be4a11@cherr.cc> From: "Shengzhuo Wei" Received: from [192.168.9.107] ([111.42.148.30]) by smtp.feishu.cn with ESMTPS; Fri, 04 Sep 2026 04:15:53 +0800 X-Lms-Return-Path: To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" , "Fugang Duan" Cc: , , , , "Shengzhuo Wei" Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Subject: [PATCH net 2/2] net: fec: free the PPS interrupt before tearing down the PHC and netdev Message-Id: <20260904-fec-ptp-pps-event-uaf-v1-2-9af446be4a11@cherr.cc> Content-Type: text/plain; charset="utf-8" The dedicated PPS interrupt is devm-managed, so its handler remains registered until device-managed resources are released after the remove callback returns. It therefore outlives both fec_ptp_stop() and free_netdev(). A handler already in flight can observe pps_enable before fec_ptp_stop() clears it and call ptp_clock_event() concurrently with ptp_clock_unregister(). A handler invoked after free_netdev() but before device-managed cleanup dereferences the freed netdev. Record the IRQ after a successful request and release it explicitly in fec_ptp_stop(), before unregistering the PHC. devm_free_irq() removes the handler and waits for any running instance, so none can still execute when PHC teardown begins. The IRQ is requested without IRQF_SHARED, so its release does not affect another handler. Fixes: 4ad1ceec05e4 ("net: fec: Let fec_ptp have its own interrupt routine") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 11 ++++++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/fr= eescale/fec.h index 7176803146f3..960b9f01c531 100644 --- a/drivers/net/ethernet/freescale/fec.h +++ b/drivers/net/ethernet/freescale/fec.h @@ -670,6 +670,7 @@ struct fec_enet_private { =20 /* pps */ int pps_channel; + int pps_irq; unsigned int reload_period; int pps_enable; unsigned int next_counter; diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/etherne= t/freescale/fec_ptp.c index 0036549974fd..5b1d58c85fcd 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -787,9 +787,12 @@ void fec_ptp_init(struct platform_device *pdev, int ir= q_idx) if (irq >=3D 0) { ret =3D devm_request_irq(&pdev->dev, irq, fec_pps_interrupt, 0, pdev->name, ndev); - if (ret < 0) + if (ret < 0) { dev_warn(&pdev->dev, "request for pps irq failed(%d)\n", ret); + } else { + fep->pps_irq =3D irq; + } } =20 fep->ptp_clock =3D ptp_clock_register(&fep->ptp_caps, &pdev->dev); @@ -861,6 +864,12 @@ void fec_ptp_stop(struct platform_device *pdev) =20 cancel_delayed_work_sync(&fep->time_keep); hrtimer_cancel(&fep->perout_timer); + + if (fep->pps_irq > 0) { + devm_free_irq(&pdev->dev, fep->pps_irq, ndev); + fep->pps_irq =3D 0; + } + if (fep->ptp_clock) { ptp_clock_unregister(fep->ptp_clock); fep->ptp_clock =3D NULL; --=20 2.47.3