From: Tristan Madani ncsi_remove_channel(), ncsi_remove_package(), and ncsi_unregister_dev() each call list_del_rcu() to remove an entry from an RCU-protected list, then immediately call kfree(). Concurrent RCU readers traversing the list may still hold references to the freed object. A similar pattern was already fixed in the VLAN list, but these three sites were missed. Replace kfree() with kfree_rcu_mightsleep() to defer the free until after an RCU grace period. Fixes: 2d283bdd5b20 ("net/ncsi: Package and channel management") Cc: stable@vger.kernel.org Signed-off-by: Tristan Madani --- net/ncsi/ncsi-manage.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c index 54d0df0a9efe6..64274a5058346 100644 --- a/net/ncsi/ncsi-manage.c +++ b/net/ncsi/ncsi-manage.c @@ -263,7 +263,7 @@ static void ncsi_remove_channel(struct ncsi_channel *nc) np->channel_num--; spin_unlock_irqrestore(&np->lock, flags); - kfree(nc); + kfree_rcu_mightsleep(nc); } struct ncsi_package *ncsi_find_package(struct ncsi_dev_priv *ndp, @@ -326,7 +326,7 @@ void ncsi_remove_package(struct ncsi_package *np) ndp->package_num--; spin_unlock_irqrestore(&ndp->lock, flags); - kfree(np); + kfree_rcu_mightsleep(np); } void ncsi_find_package_and_channel(struct ncsi_dev_priv *ndp, @@ -1969,6 +1969,6 @@ void ncsi_unregister_dev(struct ncsi_dev *nd) disable_work_sync(&ndp->work); - kfree(ndp); + kfree_rcu_mightsleep(ndp); } EXPORT_SYMBOL_GPL(ncsi_unregister_dev); -- 2.47.3