From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C4062D73A6 for ; Tue, 19 May 2026 13:47:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779198466; cv=none; b=Cq9P3+2V59h39fS2o6uZy5h4trQZDHcNoXZrztk1fF7oBc8zHSJZU51jjtURzrCpn6vsWjZ1qdpsI9+qA0CIalQt+/RQFn1uSI7FTnQEnKbV9i+1SkPskoK1RDfCq5MLOzI3owIK0vKuE5aZ6GEZ0GXX2iUfomOYEKBCEkVY5j4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779198466; c=relaxed/simple; bh=7JqWoslFjqYidf1jj/qMD6YjftUZTgJkhwSYulq67mM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=QmyzA1RHES7+s7Kt+KVozQI8JMEKwM2dmytmy11o++D8EnQE2OoYqE0BId41jzB4iSZDV+hUK9XR7mjIWXkHm2UCxNFJ+HjJTb5sY3KnD+0FhMpwzYoYybUMcigOZ0npVLReqOKMuIetK1Mj0xUa8ee+XGwz4O2rH8bINtNFLRE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=DTsAC1R1; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=QbUPNNXi; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="DTsAC1R1"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="QbUPNNXi" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779198464; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fFmkk0iPYTHgZ5VzODm8MFyiP+vyFjqDvvRAvBmLKn0=; b=DTsAC1R1eXuLz4MG44vjzPr/NRBnTsf7HsAS8RbtXbUJsmPyjLcOLf9hEyixkaqcfUbyUw C/VkeYKN5LAMkAnvnpRF9JqBrnpdkLU/C9HwitFCA5iktWLYjt6y27JJiJs4HuzRUQMy49 0FjOS5pX+L1eeAfLERNr9ndFTXDFmP8= Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-478-FxlNThWzN52tBDsjxp8sWg-1; Tue, 19 May 2026 09:47:42 -0400 X-MC-Unique: FxlNThWzN52tBDsjxp8sWg-1 X-Mimecast-MFC-AGG-ID: FxlNThWzN52tBDsjxp8sWg_1779198461 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-45e81291d62so1921865f8f.1 for ; Tue, 19 May 2026 06:47:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1779198460; x=1779803260; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=fFmkk0iPYTHgZ5VzODm8MFyiP+vyFjqDvvRAvBmLKn0=; b=QbUPNNXiW20nsoyE93KB1/QuE4VOGtFRPdGgITJwqGXpIUWCO/zGr5qbYXnJxDqVt2 EuyeI9RuWdZ00B4HaD/R3GwM9gNB26gTiG/ByEpGX2GuUwMQaA+74SH90+CfI56D9YM9 fSwkFsKXe2WD5Nl9BUoIU9L/MfurjGqFVmAE0FeCEZfETU0zRYc2XT8aGxw+ODCuzmd/ 64XIloSdJFzuz1bX8j8rd2d8R/jrZ0Jpc3DwTyjVQWO1xpvZOBtP0mhZmiG3J4AtQPKr oLydOvfQbiO18UVgAcN46V2qyTmSsKkYuP4Xo6FVBbHe9ooTUxoscTTGATLNY25Kx8XX d2tA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779198460; x=1779803260; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=fFmkk0iPYTHgZ5VzODm8MFyiP+vyFjqDvvRAvBmLKn0=; b=mM2UhYlBm33jp/U6tI7ZI88xQJhie0DTn11AQmrEzkTFVwmkHJAtnUGkBpGGnSTAjH B0/nVI/9/E/OVH485rLo+tGS05PsZZgvbUHVFS57hfxt0UuT9LYm73QF+5wsSm7my4p4 aHf6G8Uvzpic5IFzlEnfgOhp2nNzYZKwDbKP8C+BKprXpwk915CKizmIdbiQAGLiYZyl HJlKHLnMPSXTZKPLz4G456fyDkn2oAEg4tdn1ysGjo3SVc36HlNVzW8UzcRrdcaK/rXU uYFl4TjdvMk4Kn4WP3LV1evxRzMPp7ZH5GXNSQDTEfbqx1OGZ3kIBnJg/lk1jq3g4QVl W8Gg== X-Forwarded-Encrypted: i=1; AFNElJ/LsMa7wAHX5sWgNsTP9G1NHYuRQsYp/JZz37H3hVXvfdgv6m8sjo/Zxh1QFFAPDvTZK7bif+xc0a0goIc=@vger.kernel.org X-Gm-Message-State: AOJu0YyV0YcXwqj23FFGbTgs+L+PBtWNFYarxb6Q6t0h8gTtdz71JlQM LkN57XQGfQMrPOHc/oI0cRm9csZnsGhT3VcNiiK4Rvg+jQJTpp8alRrCr7ypmAtaFu+owBxYBZB Gc7rtpJ7PmPTS8PejDGjtAeFW0/0yOzvawZPH+KrNOj96SQXffsiZajX9cNyP1qJ/Pg== X-Gm-Gg: Acq92OEC3/rSsF202gyfqH7eEFgE9xNwYH2u9o/Ak+GCojTjcdhlPC8floz5IKz9zXB N8MN17hKSVWkNVgLcHrxI2Qkpodyai2R9RL1vt0Br0/tzE+liOr79yLDBbXrmJvJvEpKCDj6kgS pHbfzDYQUzGhU/RNzghmAMIIe/EXYVl2fIu0yKkkrfxN+T8SN9+cKzYigQhzrPtvbxY4uncCdy6 sfDvw7ygaGmcserNIlZdKUSjtX/1AIBlp8ilj6lzvlDY56pln88YstU6FabTIH/Jt1kCxNX+aRk VVhfXQWQns37u7fqBTRVvYtFFy1s+a0K+We+sFBDZvDz4SAzsLINQ8tR1jiOA+9qyI6XYaePpX3 bPcbDPxj38GTQtRu0SuMPEfCgimpsJjf97DugvZLWNdqVD5zyArP8D7k= X-Received: by 2002:a05:600c:c086:b0:48a:563c:c8c5 with SMTP id 5b1f17b1804b1-48fe60eabddmr224654035e9.8.1779198460633; Tue, 19 May 2026 06:47:40 -0700 (PDT) X-Received: by 2002:a05:600c:c086:b0:48a:563c:c8c5 with SMTP id 5b1f17b1804b1-48fe60eabddmr224653725e9.8.1779198460221; Tue, 19 May 2026 06:47:40 -0700 (PDT) Received: from [192.168.88.32] ([150.228.25.33]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48fe4c833fcsm327744395e9.2.2026.05.19.06.47.39 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 19 May 2026 06:47:39 -0700 (PDT) Message-ID: <6ab22cc7-57d1-40d2-888b-76f0905ad5a2@redhat.com> Date: Tue, 19 May 2026 15:47:38 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v1] net: plip: cancel pending work before freeing device To: Sicong Huang , netdev@vger.kernel.org Cc: andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, linux-kernel@vger.kernel.org References: <20260515063155.3196112-1-congei42@163.com> From: Paolo Abeni Content-Language: en-US In-Reply-To: <20260515063155.3196112-1-congei42@163.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 5/15/26 8:31 AM, Sicong Huang wrote: > plip_close() stops the IRQ and the poll timer but does not cancel > the immediate and deferred work items before returning. These two > work items are initialised in plip_init_netdev() via > INIT_WORK(&nl->immediate, plip_bh) and > INIT_DELAYED_WORK(&nl->deferred, plip_kick_bh). > plip_cleanup_module() calls free_netdev() which frees the > net_local structure while those work items may still be queued or > running in the workqueue, resulting in a use-after-free. > > Fix this by calling cancel_delayed_work_sync() and cancel_work_sync() > after all sources of new work scheduling have been shut down (IRQ > disabled, poll timer stopped) but before releasing parport and > freeing any skbs. > > Signed-off-by: Sicong Huang This is a fix, should target the 'net' tree including such tag in the subj prefix and should include a suitable 'Fixes:' tag in the tag area. Please have an accurate read at: Documentation/process/maintainer-netdev.rst before reposting. > --- > drivers/net/plip/plip.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/net/plip/plip.c b/drivers/net/plip/plip.c > index d81163bc910a..4f0ab14f2024 100644 > --- a/drivers/net/plip/plip.c > +++ b/drivers/net/plip/plip.c > @@ -1141,6 +1141,9 @@ plip_close(struct net_device *dev) > wait_for_completion(&nl->killed_timer_cmp); > } > > + cancel_delayed_work_sync(&nl->deferred); > + cancel_work_sync(&nl->immediate); Sashiko noted this is still racy: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260515063155.3196112-1-congei42%40163.com you should likely call disable_* at deattach() time. /P