Re: [PATCH net v3 3/3] net: pse-pd: unregister from the controller list before freeing PI data

[Kory Maincent]

On 8/13/26 22:06, Carlo Szelinsky wrote:
> pse_controller_unregister() frees the PI array with pse_release_pis()
> while the controller is still linked on pse_controller_list, and only
> removes it from the list afterwards. A concurrent consumer probe running
> of_pse_control_get() walks that list under pse_list_mutex and calls
> of_pse_match_pi(), which dereferences pcdev->pi[i].np. If the walk lands
> on a controller that is being torn down, it reads the freed (with the
> previous patch, NULLed) PI array.
>
> Move the list_del() ahead of pse_release_pis(). Both the lookup and the
> removal serialise on pse_list_mutex, so once the controller is unlinked
> no new lookup can reach it, and any lookup already in progress holds the
> mutex and has matched against a live pi before the free can run. No NULL
> checks are needed on the lookup path.
>
> Fixes: 9be9567a7c59 ("net: pse-pd: Add support for PSE PIs")
> Signed-off-by: Carlo Szelinsky <github@xxxxxxxxxxxx>

Reviewed-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>

Thank you!
--
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com