From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8327A3CA4AD for ; Thu, 2 Jul 2026 23:50:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783036249; cv=none; b=Yf3Cv5dKyuy/naz4aQkUPVheW/DD9TaIbfyz361mFOJeJa7ubYUIedF2f/bZx3ZiefmGtRWP3pMcy39oJtreQidu+73eIxRhzr2ZopdChidUKPpYjTeljDtabx3L+kAgZVWphOG83WC5EP9uYTf2SvPl0uo6NN/y5v8q7qEbv1s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783036249; c=relaxed/simple; bh=qxVC+PhAdInHEFda3IbTj5Vu/foDrosmc8KQKtJ9tv0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=VJa8ezXsyd2vKLW8kXYTx5NdHsefRDMNdsQ4CiyDrj4upb/92HZKuX0Dw4kQlpwcPX+hlCsh3+/tG6wrgZu765XEUhSPsxlCLpNf/AWHIZR/YzfxX+5ZUOhXRbbsUZd2ny5xyh33FWNRSKgQHmkeZUAHsny8YRbDaJaG1QehUUM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=eo8/LSMA; arc=none smtp.client-ip=209.85.210.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="eo8/LSMA" Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-84780c95e2eso1657959b3a.3 for ; Thu, 02 Jul 2026 16:50:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783036248; x=1783641048; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=fw5m2ZAAuYdtnFzlSxNxzYWs1oA4+6H1+UmVCec80cA=; b=eo8/LSMAZfjdCrp4MuKdCRv48LD1DStL31O8/99QOQcZN4pm6CUIceyuVHtU6BZC3z wZyfhTBHTE7yoYBfBQJChBXM/X3AQ51snz8tsgzAWEj0tvzPSSCR9/rkut4ng7+y2fkQ rjiQxk33aj9LceUIzKYnGVitUW5jSIqoCokcyW6dL5LAHFY/P+Gq/1S7rzwtltgZb52j HmmIuZPA4cMstb6AlLs6/MuNqEcxqrzeXWCEpyVxbfK+YBzJdQ/R29RnDn8gh5DWWjZ4 O/JU33rWIAxnLklbHWuMf4i6L4PIF1lCLREJOqQLQdasFRfy/Mrod78pVQgPhWa8x47O s1QA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783036248; x=1783641048; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=fw5m2ZAAuYdtnFzlSxNxzYWs1oA4+6H1+UmVCec80cA=; b=dBzgoTsN9to9UZjlawqy8/lwuCPKTCVLeYuz/rdLJRW7gD3luh9ybIWHFZrZsEULqz CAFFmM5xG2jkukgoavEcLH7b5BAFusD5Ki97gaVctFWhZAHQCxSbLDnqzbY44+vxqn2p 9AaZmEjuG+uzxdMdwDkxkLIs6g3RFuetD5zC43z9ffkLIYmBb7nwEmnKScwFDiy2Hec4 6zk4oKH68bOruT+BaK7HLA0jmvtSLD1z1dtLBVRylVzFgnN6j4udwhgiuvViQ1EvO0Vg fF2NMyQfVjAlIE+6/VF9P0l/TZ06UQ49Wh4vjhLnloyUT2CeL/1jH1Qkrdi/Pp0blmQ5 n0sA== X-Forwarded-Encrypted: i=1; AFNElJ8mXal+AXYApda34XE6vJv2gJ1zCCZIMl+p1xhbUmNt0VMZOqVOoth+ARL3PmW0BdAmZUsT0BDfSf3bwqE=@vger.kernel.org X-Gm-Message-State: AOJu0Ywljj9azHisKd1HP30pX8HY+/XRl6F04uqzassFo7xdE0IyLcMH EYqb7Yov0H8OL2XAjdWRFmd+XJ8dtMY4HNvYL/lWtkOKBTx8h63/8XF6 X-Gm-Gg: AfdE7cnjGZ8niScYMZmKCRQgSCVG8wGLRT6+4s2ztQzgmpRqbBiWSL5sjONRDdukXEU 3+0wROB6jjZyvea3Xp1IQhuUVvfUE5Bl8lQf40DXxEmxjt7cQuzA2QUN3NpOwLPKqPbHeMg10Oi +wS4y3i8eeiWY5ZH10otxeDq+RqM5v/XqP6vHtTM+RN9M4I+uH9a8DEQD5brS65v8bKg1p9+Wz6 hGg6f/pTJV2QvuAodB5YvjOzDCae0Zk8LC+dXCW1PmTa4d4f8VZPB+SIfOp2XblFHWkw/Gp+nJ/ EPCRhBhnh2VKF5MoDFIwPotqboA4vf0J15Y0p4MINNztMBUxtrGLaeaEeM/3zyJw/v4L9tat7Gw leA89eS7bX2rnZmoFLUsMjU6GqjD3QEtjrHeNs9FHTBMNgoLo9qONYBbNMP+oUdFoJkdw9zr9Ig tBDL0PG0QZlnTfKw0A/Tptq4KvKJU9wfMzxKjQhtA6BXjzsi5kzH0GN5RgtoWH6SuDIolGULz8a 7sVQtD+vOWlbwvFRjoA X-Received: by 2002:a05:6a00:6c85:b0:847:9c06:2bef with SMTP id d2e1a72fcca58-847c514002cmr7264602b3a.29.1783036247553; Thu, 02 Jul 2026 16:50:47 -0700 (PDT) Received: from ryzen.lan ([2601:644:8000:7a86::e35]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847cb94bd7esm1985283b3a.38.2026.07.02.16.50.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Jul 2026 16:50:47 -0700 (PDT) From: Rosen Penev To: netdev@vger.kernel.org Cc: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Rosen Penev , linux-kernel@vger.kernel.org (open list) Subject: [PATCH net] net: emac: mal: replace devm_request_irq with request_irq to fix probe error race Date: Thu, 2 Jul 2026 16:50:45 -0700 Message-ID: <20260702235045.1326384-1-rosenp@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit devm_request_irq() is a managed resource: the IRQ is not freed until devres_release_all() runs after the probe function returns. In the probe error path, free_netdev(mal->dummy_dev) and dcr_unmap() execute while the IRQ is still live. If the shared IRQ fires during cleanup, the handler accesses unmapped DCR registers (crash) or the already- freed dummy_dev (use-after-free). Switch to plain request_irq() with per-IRQ error labels that tear down only the IRQs that were successfully registered, and add the matching free_irq() calls in mal_remove(). Fixes: 14f59154ff0b ("net: ibm: emac: mal: use devm for request_irq") Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev --- drivers/net/ethernet/ibm/emac/mal.c | 43 +++++++++++++++++++---------- 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c index eab7a487bf08..5c3bf05ca6a5 100644 --- a/drivers/net/ethernet/ibm/emac/mal.c +++ b/drivers/net/ethernet/ibm/emac/mal.c @@ -656,26 +656,26 @@ static int mal_probe(struct platform_device *ofdev) hdlr_rxde = mal_rxde; } - err = devm_request_irq(&ofdev->dev, mal->serr_irq, hdlr_serr, irqflags, - "MAL SERR", mal); + err = request_irq(mal->serr_irq, hdlr_serr, irqflags, + "MAL SERR", mal); if (err) goto fail_dummy; - err = devm_request_irq(&ofdev->dev, mal->txde_irq, hdlr_txde, irqflags, - "MAL TX DE", mal); + err = request_irq(mal->txde_irq, hdlr_txde, irqflags, + "MAL TX DE", mal); if (err) - goto fail_dummy; - err = devm_request_irq(&ofdev->dev, mal->txeob_irq, mal_txeob, 0, - "MAL TX EOB", mal); + goto fail_serr_irq; + err = request_irq(mal->txeob_irq, mal_txeob, 0, + "MAL TX EOB", mal); if (err) - goto fail_dummy; - err = devm_request_irq(&ofdev->dev, mal->rxde_irq, hdlr_rxde, irqflags, - "MAL RX DE", mal); + goto fail_txde_irq; + err = request_irq(mal->rxde_irq, hdlr_rxde, irqflags, + "MAL RX DE", mal); if (err) - goto fail_dummy; - err = devm_request_irq(&ofdev->dev, mal->rxeob_irq, mal_rxeob, 0, - "MAL RX EOB", mal); + goto fail_txeob_irq; + err = request_irq(mal->rxeob_irq, mal_rxeob, 0, + "MAL RX EOB", mal); if (err) - goto fail_dummy; + goto fail_rxde_irq; /* Enable all MAL SERR interrupt sources */ set_mal_dcrn(mal, MAL_IER, MAL_IER_EVENTS); @@ -694,6 +694,14 @@ static int mal_probe(struct platform_device *ofdev) return 0; + fail_rxde_irq: + free_irq(mal->rxde_irq, mal); + fail_txeob_irq: + free_irq(mal->txeob_irq, mal); + fail_txde_irq: + free_irq(mal->txde_irq, mal); + fail_serr_irq: + free_irq(mal->serr_irq, mal); fail_dummy: free_netdev(mal->dummy_dev); fail_unmap: @@ -718,6 +726,13 @@ static void mal_remove(struct platform_device *ofdev) mal_reset(mal); + /* Free IRQs before freeing resources they access */ + free_irq(mal->serr_irq, mal); + free_irq(mal->txde_irq, mal); + free_irq(mal->txeob_irq, mal); + free_irq(mal->rxde_irq, mal); + free_irq(mal->rxeob_irq, mal); + free_netdev(mal->dummy_dev); dcr_unmap(mal->dcr_host, 0x100); -- 2.55.0