The TX and RX IRQ handlers can schedule dma_err_tasklet. Killing the tasklet before freeing the IRQs leaves a window for either handler to schedule it again. The tasklet can then access descriptors and TX skb state after nixge_stop() releases them. Free both IRQs before tasklet_kill() so the IRQ handlers have finished and cannot queue further error recovery when the tasklet is drained. Fixes: 492caffa8a1a ("net: ethernet: nixge: Add support for National Instruments XGE netdev") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/net/ethernet/ni/nixge.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/ni/nixge.c b/drivers/net/ethernet/ni/nixge.c index 230d5ff..8697a76 100644 --- a/drivers/net/ethernet/ni/nixge.c +++ b/drivers/net/ethernet/ni/nixge.c @@ -927,11 +927,12 @@ static int nixge_stop(struct net_device *ndev) nixge_dma_write_reg(priv, XAXIDMA_TX_CR_OFFSET, cr & (~XAXIDMA_CR_RUNSTOP_MASK)); - tasklet_kill(&priv->dma_err_tasklet); - + /* Remove both producers before draining the error tasklet. */ free_irq(priv->tx_irq, ndev); free_irq(priv->rx_irq, ndev); + tasklet_kill(&priv->dma_err_tasklet); + nixge_hw_dma_bd_release(ndev); return 0; -- 2.53.0