RE: [PATCH net] net: qualcomm: rmnet: fix TX aggregation teardown race

[subash.a.kasiviswanathan]

> -----Original Message-----
> From: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> Sent: Sunday, November 1, 2026 4:34 PM
> To: Subash Abhinov Kasiviswanathan
> <subash.a.kasiviswanathan@xxxxxxxxxxxxxxxx>; Sean Tranchetti
> <sean.tranchetti@xxxxxxxxxxxxxxxx>
> Cc: netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Jérémy Jean
> <Jeremy.Jean@xxxxxxxxxxxxxxxxx>; stable@xxxxxxxxxxxxxxx
> Subject: [PATCH net] net: qualcomm: rmnet: fix TX aggregation teardown race
> 
> There is a race in rmnet_unregister_real_device() because it cancels TX
> aggregation before unregistering the rx handler. A transmit that already
> obtained the port through rmnet_get_port_rcu() can wait on port->agg_lock,
> then create a new aggregate and rearm the timer after
> rmnet_map_tx_aggregate_exit() has drained it. The timer can later queue work
> on the freed port.
> 
> Unregister the rx handler first so that no reader can rearm aggregation after
> rmnet_map_tx_aggregate_exit() drains it.
> 
> Fixes: 64b5d1f8f2d1 ("net: qualcomm: rmnet: add tx packets aggregation")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> ---
>  drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> index 61b04c6c0390..2ff4b9519139 100644
> --- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> +++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
> @@ -40,10 +40,10 @@ static int rmnet_unregister_real_device(struct
> net_device *real_dev)
>  	if (port->nr_rmnet_devs)
>  		return -EINVAL;
> 
> -	rmnet_map_tx_aggregate_exit(port);
> -
>  	netdev_rx_handler_unregister(real_dev);
> 
> +	rmnet_map_tx_aggregate_exit(port);
> +
>  	kfree(port);
> 
>  	netdev_dbg(real_dev, "Removed from rmnet\n");
> --
> 2.47.3

Reviewed-by: Subash Abhinov Kasiviswanathan <subash.a.kasiviswanathan@xxxxxxxxxxxxxxxx>