Re: [PATCH net] net: qcom/emac: Fix use after free bug in emac_remove due to race condition

From: Zheng Hacker
Date: Mon Mar 13 2023 - 22:12:01 EST


Jakub Kicinski <kuba@xxxxxxxxxx> 于2023年3月14日周二 08:00写道:
>
> On Fri, 10 Mar 2023 18:57:34 +0800 Zheng Wang wrote:
> > + netif_carrier_off(netdev);
> > + netif_tx_disable(netdev);
> > + cancel_work_sync(&adpt->work_thread);
> > unregister_netdev(netdev);
> > netif_napi_del(&adpt->rx_q.napi);
>
> same problem as in the natsemi driver

Hi Jakub,

Thanks for your reply. Here we schedule the work when handling IRQ
request, So I think we should add free_irq after netif_napi_del and move
the cancel_work_sync after that like:

netif_carrier_off(netdev);
netif_tx_disable(netdev);

unregister_netdev(netdev);
netif_napi_del(&adpt->rx_q.napi);

free_irq(adpt->irq.irq, &adpt->irq);
cancel_work_sync(&adpt->work_thread);

Apprecaite for your advice about the fix.

Best regards,
Zheng