From nobody Fri Sep 25 20:54:20 2026 Received: from sg-2-1.ptr.blmpb.com (sg-2-1.ptr.blmpb.com [71.18.227.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC47654CF72 for ; Tue, 8 Sep 2026 16:34:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788885246; cv=none; b=HRBI8LDdaa850AqDii55sa1hWqY1f3/GNM0LsBxJzyvMCsrhOW/yhe26KaWxCKty6ZSbOYxe4zlD5Hm5eob3UreQ4lPGwI6xvyKPMK9LH5qeuz3Z95+bslUOO66blXujyS8qB+8rR21lHMvawxwdTGdeLC2knzYNNR27tTpfPnI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788885246; c=relaxed/simple; bh=YFk8ijcB8bITxXkCpEHcDU++XgwznV4djJXfOVSeN0M=; h=Subject:Message-Id:References:Mime-Version:Content-Type:To:From: Date:In-Reply-To:Cc; b=hXvhgV3Z29LYEH0wKw8bN/Ohk/Kf/esXZ0XhiQOLclmj6P3wGXfJj/IJeOWwIH3bEAPQwm29iqSzYhrFdpXoEsSk5j4N6ceie5wX95QfH/undYp7r6o4B+7ryYJ/cbWUzrLC9DQiI2Ct+ILTayU19rVhoL4zZEpKwqPOH4CoWH4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=Pe1EsDES; arc=none smtp.client-ip=71.18.227.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="Pe1EsDES" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788885232; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=JuHLfjAtbzVg6yDfxoJ2zvQ9bI5H2+ld+xQJ8ev3rsQ=; b=Pe1EsDESVpoGmfwsSVlnnkj9eknZ4zgJW86MSu+r8dXoSAgsePP8uZrvdn0NzL6SkjJMot a49Q4gH1ghlKpqpcnI2VXvZ8vogw71Q+43MSWZ1Xf7R4kRREs+RTJiYaIFiwcFrxIJjk7C viBz6MOvVDMJ7dFhncvYknaaMYWEm/YfRdVodow/ukbiWnN0vmJe0suuKJjmYSboc/bXuC VZKWYWOBFFjo0y688KKjqjuhw0ZFkKi8Ne8JymgBsTu82DEk8kf4QlycKnedxBwqzF6Kwc 3ylIU7/lcX3plHUGcBnPI3cLwrHoEEqdKn5rjr5JkNzEOVeH7qvHdUJIBKeU/w== X-Lms-Return-Path: Subject: [PATCH net v3 1/2] net: fec: stop the PTP clock after the netdev is unregistered Message-Id: <20260909-fec-ptp-pps-event-uaf-v3-1-bead12c29a16@cherr.cc> Content-Transfer-Encoding: quoted-printable References: <20260909-fec-ptp-pps-event-uaf-v3-0-bead12c29a16@cherr.cc> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 Received: from [192.168.9.107] ([111.42.148.75]) by smtp.feishu.cn with ESMTPS; Wed, 09 Sep 2026 00:33:49 +0800 X-Mailer: b4 0.16.0 To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" From: "Shengzhuo Wei" Date: Wed, 09 Sep 2026 00:33:44 +0800 In-Reply-To: <20260909-fec-ptp-pps-event-uaf-v3-0-bead12c29a16@cherr.cc> Cc: "Simon Horman" , "Phuc" , , , , , "Shengzhuo Wei" X-Original-From: Shengzhuo Wei Content-Type: text/plain; charset="utf-8" fec_drv_remove() unregisters the PTP clock before unregistering the netdev. A concurrent ethtool -T can therefore pass a freed PTP clock to ptp_clock_index() through fec_enet_get_ts_info(). Move fec_ptp_stop() after unregister_netdev(), which drains the ethtool callbacks before the PTP clock is torn down. Leave the probe error path unchanged, since the netdev has not been registered there. Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fai= l path") Cc: stable@vger.kernel.org Suggested-by: Wei Fang Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethern= et/freescale/fec_main.c index 794ec427b0ee..a29c8ddbbf34 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -5500,9 +5500,9 @@ fec_drv_remove(struct platform_device *pdev) ERR_PTR(ret)); =20 cancel_work_sync(&fep->tx_timeout_work); + unregister_netdev(ndev); if (fep->bufdesc_ex) fec_ptp_stop(pdev); - unregister_netdev(ndev); fec_enet_mii_remove(fep); if (fep->reg_phy) regulator_disable(fep->reg_phy); --=20 2.47.3 From nobody Fri Sep 25 20:54:20 2026 Received: from sg-2-5.ptr.blmpb.com (sg-2-5.ptr.blmpb.com [71.18.227.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E21F8585964 for ; Tue, 8 Sep 2026 16:34:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=71.18.227.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788885247; cv=none; b=tjE+qlske7SMKV0s/SVBfMJReTDIf6VgaDiAYy+dujHBrZBr40ff0r9CI8cuAuMIcATQhVnb8zRFtkCCjGb2XWAsWhAAt79l6aZQjd9Z80xknJutTSLL/+W79YnZjaYJMhl7Kzil9uEJc3d6jKWkGoST//W6yYBztaMNxgEclh8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788885247; c=relaxed/simple; bh=YyFIg1NsOu0NtPYilkmK9kY41D3hnIge48BKVfmCSFk=; h=Mime-Version:Cc:From:Subject:Date:To:Message-Id:References: Content-Type:In-Reply-To; b=hyNBJ8/tlHmELyT047MKR9/aeKWhA3loorsrtDl9Cxd3GX5H6AN/fiAidTFkyH4wihqAxBPa2Y7T87BGG7DS0iV8yPSJs4bWeL4+AV+VA65n30ZqwHo3/lqqdpTZsd+t/YTEPpny687o/MjP1p8CvdVswUjutCqXH1wZi9l2kBw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc; spf=pass smtp.mailfrom=cherr.cc; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b=KL56Ktev; arc=none smtp.client-ip=71.18.227.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=cherr.cc Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=cherr.cc Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=cherr.cc header.i=@cherr.cc header.b="KL56Ktev" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=feishu2604220257; d=cherr.cc; t=1788885234; h=from:subject: mime-version:from:date:message-id:subject:to:cc:reply-to:content-type: mime-version:in-reply-to:message-id; bh=HmJJWTtwKXJC2s3lconQn6RhpXL4dm6si2ig3DGVaD0=; b=KL56KtevjnYMnuT9JWwvK6IrTIICLZO/3AV/PujZEQoQbiPqAdIYiPpkD63ybyEBd3SL3G AZOb72dqiy8obOdzj2O1NlezfxnUR0kAY1OFgu8ue80ZYYvXELSapQeSLB195jeMcJS9w2 PSyuQ1F3ARHL534lsYue07yCO3nOlFQifBYjeEhtA5JQfQdbyHRe6r/WO6nj0LW2F1xo2H f6rokY9dHydyrAWkQRimw3ucQ/JYrQoK2aEF0hHzdESnKcZnnx4nh0muxOzaYpRBi/krq6 PZWAKAPQxCphq9nq0py2cyTH6hf/23oJazoOh3bCKC7KwOgkbzTRWNlNna1J5w== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Lms-Return-Path: Cc: "Simon Horman" , "Phuc" , , , , , "Shengzhuo Wei" From: "Shengzhuo Wei" Subject: [PATCH net v3 2/2] net: fec: free the PPS interrupt before tearing down the PHC and netdev Date: Wed, 09 Sep 2026 00:33:45 +0800 To: "Wei Fang" , "Frank Li" , "Shenwei Wang" , "Andrew Lunn" , "David S. Miller" , "Eric Dumazet" , "Jakub Kicinski" , "Paolo Abeni" , "Richard Cochran" , "Troy Kisky" , "Fugang Duan" , "Lucas Stach" Content-Transfer-Encoding: quoted-printable Received: from [192.168.9.107] ([111.42.148.75]) by smtp.feishu.cn with ESMTPS; Wed, 09 Sep 2026 00:33:51 +0800 Message-Id: <20260909-fec-ptp-pps-event-uaf-v3-2-bead12c29a16@cherr.cc> References: <20260909-fec-ptp-pps-event-uaf-v3-0-bead12c29a16@cherr.cc> X-Original-From: Shengzhuo Wei X-Mailer: b4 0.16.0 In-Reply-To: <20260909-fec-ptp-pps-event-uaf-v3-0-bead12c29a16@cherr.cc> Content-Type: text/plain; charset="utf-8" The devm-managed PPS interrupt remains registered until after the remove callback returns, outliving both the PHC and the netdev. An in-flight handler can call ptp_clock_event() during PHC teardown, and a later interrupt can dereference the freed netdev. Use request_irq() and record the IRQ after a successful request, then release it with free_irq() in fec_ptp_stop(), before ptp_clock_unregister(). This removes the handler and waits for any running instance to finish before the PHC and netdev are torn down. Fixes: 4ad1ceec05e4 ("net: fec: Let fec_ptp have its own interrupt routine") Cc: stable@vger.kernel.org Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec.h | 1 + drivers/net/ethernet/freescale/fec_ptp.c | 12 ++++++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/fr= eescale/fec.h index 7176803146f3..960b9f01c531 100644 --- a/drivers/net/ethernet/freescale/fec.h +++ b/drivers/net/ethernet/freescale/fec.h @@ -670,6 +670,7 @@ struct fec_enet_private { =20 /* pps */ int pps_channel; + int pps_irq; unsigned int reload_period; int pps_enable; unsigned int next_counter; diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/etherne= t/freescale/fec_ptp.c index 56801c2009d5..598cd8024123 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -778,6 +778,7 @@ void fec_ptp_init(struct platform_device *pdev, int irq= _idx) hrtimer_setup(&fep->perout_timer, fec_ptp_pps_perout_handler, CLOCK_REALT= IME, HRTIMER_MODE_REL); =20 + fep->pps_irq =3D -1; irq =3D platform_get_irq_byname_optional(pdev, "pps"); if (irq < 0) irq =3D platform_get_irq_optional(pdev, irq_idx); @@ -785,11 +786,12 @@ void fec_ptp_init(struct platform_device *pdev, int i= rq_idx) * only the PTP_CLOCK_PPS clock events should stop */ if (irq >=3D 0) { - ret =3D devm_request_irq(&pdev->dev, irq, fec_pps_interrupt, - 0, pdev->name, ndev); + ret =3D request_irq(irq, fec_pps_interrupt, 0, pdev->name, ndev); if (ret < 0) dev_warn(&pdev->dev, "request for pps irq failed(%d)\n", ret); + else + fep->pps_irq =3D irq; } =20 fep->ptp_clock =3D ptp_clock_register(&fep->ptp_caps, &pdev->dev); @@ -861,6 +863,12 @@ void fec_ptp_stop(struct platform_device *pdev) =20 cancel_delayed_work_sync(&fep->time_keep); hrtimer_cancel(&fep->perout_timer); + + if (fep->pps_irq >=3D 0) { + free_irq(fep->pps_irq, ndev); + fep->pps_irq =3D -1; + } + if (fep->ptp_clock) ptp_clock_unregister(fep->ptp_clock); } --=20 2.47.3