From: Radiy Zhambakiev fealnx_remove_one() frees the DMA rings before unregistering the netdev, while the interface may still be up, which leaves a window where freed memory can be accessed. Call unregister_netdev() first so dev_close() stops the Tx/Rx engines, deletes the timers, and frees the IRQ before the rings are freed. Found by Linux Verification Center (linuxtesting.org) Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Radiy Zhambakiev --- drivers/net/ethernet/fealnx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c index bdc38aac5850..68194c9ef332 100644 --- a/drivers/net/ethernet/fealnx.c +++ b/drivers/net/ethernet/fealnx.c @@ -682,11 +682,11 @@ static void fealnx_remove_one(struct pci_dev *pdev) if (dev) { struct netdev_private *np = netdev_priv(dev); + unregister_netdev(dev); dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring, np->tx_ring_dma); dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring, np->rx_ring_dma); - unregister_netdev(dev); pci_iounmap(pdev, np->mem); free_netdev(dev); pci_release_regions(pdev); -- 2.53.0