Re: [PATCH net v2 09/14] net: pse-pd: unregister from the controller list before freeing PI data

[Oleksij Rempel]

On Tue, Oct 20, 2026 at 07:12:44PM +0200, Carlo Szelinsky wrote:
> pse_controller_unregister() frees the PI array while the controller is
> still on pse_controller_list, and only removes it from the list
> afterwards. of_pse_control_get() walks that list under pse_list_mutex
> and reads pcdev->pi[i].np in of_pse_match_pi(). A consumer that probes
> at that moment can read the freed PI array.
> 
> Remove the controller from the list first, before the worker is
> drained, the power domains are flushed and the PI array is freed. Both
> sides take pse_list_mutex, so once the controller is off the list, no
> new lookup can find it, and a lookup that is already running finishes
> before the PI array is freed.
> 
> Found by code inspection. Not reproduced.
> 
> Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
> Reviewed-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>
> Signed-off-by: Carlo Szelinsky <github@xxxxxxxxxxxx>

Acked-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx>

Thank you!
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |