From nobody Fri Sep 25 22:21:11 2026 Received: from sg-2-2.ptr.blmpb.com (sg-2-2.ptr.blmpb.com [71.18.227.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5226C26056C for ; Tue, 8 Sep 2026 02:38:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.2 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788835103; cv=none; b=a8G1F38RkqxeYzcdZ1BTxpLQmDmMNI6d7QaFSjIiMbs3yS5cY2mfbHKDKXmc7gsSM71WPTcmw5L2Tw6sz3//NPe20lFRu9kEae3LxYMDObgIaTZU3CGgHZ2abUHiCQi86vQqtvz1+ID/GqKq06DuXWAYe3Gqjxu8wW+oOVmLIMs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788835103; c=relaxed/simple; bh=YFk8ijcB8bITxXkCpEHcDU++XgwznV4djJXfOVSeN0M=; h=Date:Mime-Version:To:From:In-Reply-To:Cc:Message-Id:Content-Type: References:Subject; b=PeSIm4kul3o9VhPVXn6C757P6Qp/ADWzPkK/wOjOVVP8tMs9s/2oqr4NFbBUo2tXr/d3nR3Ak5nZEeSEh4QE+OLB0VDZos0JycKlplqDFuJdJYUmCIoIRs2KT7S/kcN2ci+uZYi2fHcT1gtQxyrALG/Tj7dPICrVTAMlp93J5MM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=1qrk53/C; arc=none smtp.client-ip=71.18.227.2 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="1qrk53/C" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788835098; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=JuHLfjAtbzVg6yDfxoJ2zvQ9bI5H2+ld+xQJ8ev3rsQ=; b=1qrk53/CQWNZ5ImCp9nbQMc3IPrEfCF7hBKPEexPhyP4wy3wKB6oK7442ao+fF/+7Jm6J9 qN2+bdrArwxpFFDhUxl1W27JViYvkjroSwXdpxUYUy7GP3FQ0e+AA+D5htCZ1WYLvmsOH5 4mlMq3qx+41acFvPGNaxlodrNYVS8m3HgUwTApaY/OO1kQjPDSiiLL4qMbArY6eZaOk0tW LKdz0qI/XQvSI1yu/8rqsnNvZicTJeKHaPucesx0d7Ptppho/3WGrMf1wXq0BGF5KyE8Gd gl+4zvoGpEd3ug0ZLUW/W50oeGmRhUxVJpjftehUt2+yMCHOh3XkEAQN8csRVw== Content-Transfer-Encoding: quoted-printable Date: Tue, 08 Sep 2026 10:37:57 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Received: from [192.168.9.107] ([111.42.148.30]) by smtp.feishu.cn with ESMTPS; Tue, 08 Sep 2026 10:38:03 +0800 X-Original-From: Shengzhuo Wei To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" From: "Shengzhuo Wei" X-Mailer: b4 0.16.0 In-Reply-To: <20260908-fec-ptp-pps-event-uaf-v2-0-2a1d57121ade@cherr.cc> Cc: "Simon Horman" , "Phuc" , , , , , "Shengzhuo Wei" Message-Id: <20260908-fec-ptp-pps-event-uaf-v2-1-2a1d57121ade@cherr.cc> References: <20260908-fec-ptp-pps-event-uaf-v2-0-2a1d57121ade@cherr.cc> Subject: [PATCH net v2 1/2] net: fec: stop the PTP clock after the netdev is unregistered X-Lms-Return-Path: Content-Type: text/plain; charset="utf-8" fec_drv_remove() unregisters the PTP clock before unregistering the netdev. A concurrent ethtool -T can therefore pass a freed PTP clock to ptp_clock_index() through fec_enet_get_ts_info(). Move fec_ptp_stop() after unregister_netdev(), which drains the ethtool callbacks before the PTP clock is torn down. Leave the probe error path unchanged, since the netdev has not been registered there. Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fai= l path") Cc: stable@vger.kernel.org Suggested-by: Wei Fang Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethern= et/freescale/fec_main.c index 794ec427b0ee..a29c8ddbbf34 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -5500,9 +5500,9 @@ fec_drv_remove(struct platform_device *pdev) ERR_PTR(ret)); =20 cancel_work_sync(&fep->tx_timeout_work); + unregister_netdev(ndev); if (fep->bufdesc_ex) fec_ptp_stop(pdev); - unregister_netdev(ndev); fec_enet_mii_remove(fep); if (fep->reg_phy) regulator_disable(fep->reg_phy); --=20 2.47.3 From nobody Fri Sep 25 22:21:11 2026 Received: from sg-2-5.ptr.blmpb.com (sg-2-5.ptr.blmpb.com [71.18.227.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CBF4F33AD88 for ; Tue, 8 Sep 2026 02:38:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788835105; cv=none; b=ZVoqJx0/62JzL+RWxUlhmAGZ7RHjHNIXOAQpWdD7l8rzET8Rl9+XD7NCGcuInOdm2VDWAUw4xVnFni/Oidzoq/+z54BobUiCPkZv53QjsUSggV0cYXqEHz9REOWnZnUj4F8wNpHnGs69In4vHICyX9StsnT0zRligbSd5yOn6cI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788835105; c=relaxed/simple; bh=pxlOfexWygBPVSw286Nocjn0c3g8NEXXEojlLnb2oyY=; h=From:To:Message-Id:References:Cc:Subject:Date:Mime-Version: In-Reply-To:Content-Type; b=H7pmmuCQg5jOyCs9a6oRs5GukVILMsB2AbIoMco+qALZSblqiH9mwUduRma5GdqyES9ER6SMyKGswnCVyKHDOuKdoYpIqtNzdNlN/rT04I4dTolMGY7U1U01of0Gne4b7kE2gauB9O15C6JayTIevVHlUcyJjmCIAFI1DOMQcJA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=wRt6i5N8; arc=none smtp.client-ip=71.18.227.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="wRt6i5N8" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788835091; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=6beIM0Su1eFg259xHdu6aLppSM3IuAgqBeGAf0Hsje0=; b=wRt6i5N84pMAv5jbhtS3bwDkDQb0VMZ5rXTihYcFUeTJodotCoZ7hoaQQBNgwPlT0spHYm KHAlqRZvd2Ca+BiUB6dlDh1JpmEGx7lDQPDDHBN/78J8neD44NOZvqo9+FxRks6uRep6Zp /U+oZ9K1ahRJeydRbSW4KDxh8ANMNjit/yaGg49NmGEhkbCOM3vrpeEvGUZ2HVduvd22q7 uuIRBvBHTWLwu0KKKUS6pyOjqh8L0IufEDm4ohgsckf5R47kSTIpfOOOj6wwEWTTetQX82 CfmK6nS5FtGoKKvkJiMyb1IaT5X1kfoFsqGcseGT/AMeCdKcLTeR1vAKWppMhw== From: "Shengzhuo Wei" Received: from [192.168.9.107] ([111.42.148.30]) by smtp.feishu.cn with ESMTPS; Tue, 08 Sep 2026 10:38:08 +0800 To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" Message-Id: <20260908-fec-ptp-pps-event-uaf-v2-2-2a1d57121ade@cherr.cc> References: <20260908-fec-ptp-pps-event-uaf-v2-0-2a1d57121ade@cherr.cc> X-Mailer: b4 0.16.0 Content-Transfer-Encoding: quoted-printable X-Original-From: Shengzhuo Wei Cc: "Simon Horman" , "Phuc" , , , , , "Shengzhuo Wei" Subject: [PATCH net v2 2/2] net: fec: free the PPS interrupt before tearing down the PHC and netdev Date: Tue, 08 Sep 2026 10:37:58 +0800 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Lms-Return-Path: In-Reply-To: <20260908-fec-ptp-pps-event-uaf-v2-0-2a1d57121ade@cherr.cc> Content-Type: text/plain; charset="utf-8" The devm-managed PPS interrupt remains registered until after the remove callback returns, outliving both the PHC and the netdev. An in-flight handler can call ptp_clock_event() during PHC teardown, and a later interrupt can dereference the freed netdev. Record the IRQ after a successful request and release it with devm_free_irq() in fec_ptp_stop(), before ptp_clock_unregister(). This removes the handler and waits for any running instance to finish before the PHC and netdev are torn down. Fixes: 4ad1ceec05e4 ("net: fec: Let fec_ptp have its own interrupt routine") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 12 +++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/fr= eescale/fec.h index 7176803146f3..960b9f01c531 100644 --- a/drivers/net/ethernet/freescale/fec.h +++ b/drivers/net/ethernet/freescale/fec.h @@ -670,6 +670,7 @@ struct fec_enet_private { =20 /* pps */ int pps_channel; + int pps_irq; unsigned int reload_period; int pps_enable; unsigned int next_counter; diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/etherne= t/freescale/fec_ptp.c index 56801c2009d5..567ea2a46117 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -778,6 +778,7 @@ void fec_ptp_init(struct platform_device *pdev, int irq= _idx) hrtimer_setup(&fep->perout_timer, fec_ptp_pps_perout_handler, CLOCK_REALT= IME, HRTIMER_MODE_REL); =20 + fep->pps_irq =3D -1; irq =3D platform_get_irq_byname_optional(pdev, "pps"); if (irq < 0) irq =3D platform_get_irq_optional(pdev, irq_idx); @@ -787,9 +788,12 @@ void fec_ptp_init(struct platform_device *pdev, int ir= q_idx) if (irq >=3D 0) { ret =3D devm_request_irq(&pdev->dev, irq, fec_pps_interrupt, 0, pdev->name, ndev); - if (ret < 0) + if (ret < 0) { dev_warn(&pdev->dev, "request for pps irq failed(%d)\n", ret); + } else { + fep->pps_irq =3D irq; + } } =20 fep->ptp_clock =3D ptp_clock_register(&fep->ptp_caps, &pdev->dev); @@ -861,6 +865,12 @@ void fec_ptp_stop(struct platform_device *pdev) =20 cancel_delayed_work_sync(&fep->time_keep); hrtimer_cancel(&fep->perout_timer); + + if (fep->pps_irq >=3D 0) { + devm_free_irq(&pdev->dev, fep->pps_irq, ndev); + fep->pps_irq =3D -1; + } + if (fep->ptp_clock) ptp_clock_unregister(fep->ptp_clock); } --=20 2.47.3