If startup_gfar() fails in gfar_enet_open(), the PHY remains connected and IRQs remain requested. Since ndo_open returned an error, IFF_UP is not set and ndo_stop (gfar_close) will not be called on unregister, leaving the IRQ handlers registered against freed net_device memory when the driver is removed. Add proper error unwinding: phy_disconnect() and gfar_free_irq() before returning the error. Fixes: 80ec396cb6b5 ("gianfar: Don't free/request irqs on device reset") Assisted-by: Opencode:Big-Pickle Signed-off-by: Rosen Penev --- drivers/net/ethernet/freescale/gianfar.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c index 89215e1ddc2d..4b3a5eaadfb5 100644 --- a/drivers/net/ethernet/freescale/gianfar.c +++ b/drivers/net/ethernet/freescale/gianfar.c @@ -2878,8 +2878,11 @@ static int gfar_enet_open(struct net_device *dev) return err; err = startup_gfar(dev); - if (err) + if (err) { + phy_disconnect(dev->phydev); + gfar_free_irq(priv); return err; + } return err; } -- 2.55.0