The software free queue is shared by both Ethernet ports, but teardown is not ordered around that ownership. On parent unbind or module unload, the parent remove callback runs before devres depopulates the child devices. It therefore destroys the queue while both child netdevs are still registered and can be doing DMA. Devres then removes each child, and both child remove callbacks destroy the same queue again, resulting in up to three cleanup attempts. Removal before the first interface has been opened is broken as well. The shared block initialization assigns a nonzero queue order, but allocation is deferred until open. Cleanup consequently derives a nonzero page count and dereferences the NULL queue ring. Depopulate both port devices before cleaning up the queue, and perform that cleanup only from the parent. Disable the free-queue interrupt after the managed handlers have drained, since its threaded handler can re-enable it. Guard cleanup for paths where no queue was allocated. Port 1 owns the shared refill interrupt, so prevent the children from being unbound independently. Unregister each netdev before detaching its PHY so ndo_stop can still access netdev->phydev. Reported-by: Myeonghun Pak Closes: https://lore.kernel.org/netdev/20260917192835.58126-1-mhun512@gmail.com/ Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Assisted-by: LLM Signed-off-by: Linus Walleij --- drivers/net/ethernet/cortina/gemini.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c index 2fe7fd0202d2..bf7652b04f1b 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -1004,6 +1004,9 @@ static void geth_cleanup_freeq(struct gemini_ethernet *geth) unsigned int pages = len >> fpp_order; unsigned int pn; + if (!geth->freeq_ring) + return; + writew(readw(geth->base + GLOBAL_SWFQ_RWPTR_REG), geth->base + GLOBAL_SWFQ_RWPTR_REG + 2); writel(0, geth->base + GLOBAL_SW_FREEQ_BASE_SIZE_REG); @@ -2387,11 +2390,10 @@ static irqreturn_t gemini_port_irq(int irq, void *data) static void gemini_port_remove(struct gemini_ethernet_port *port) { if (port->netdev) { - phy_disconnect(port->netdev->phydev); unregister_netdev(port->netdev); + phy_disconnect(port->netdev->phydev); } clk_disable_unprepare(port->pclk); - geth_cleanup_freeq(port->geth); } static void gemini_ethernet_init(struct gemini_ethernet *geth) @@ -2635,6 +2637,7 @@ static struct platform_driver gemini_ethernet_port_driver = { .driver = { .name = "gemini-ethernet-port", .of_match_table = gemini_ethernet_port_of_match, + .suppress_bind_attrs = true, }, .probe = gemini_ethernet_port_probe, .remove = gemini_ethernet_port_remove, @@ -2683,6 +2686,8 @@ static void gemini_ethernet_remove(struct platform_device *pdev) { struct gemini_ethernet *geth = platform_get_drvdata(pdev); + devm_of_platform_depopulate(&pdev->dev); + writel(0, geth->base + GLOBAL_INTERRUPT_ENABLE_4_REG); geth_cleanup_freeq(geth); geth->initialized = false; } -- 2.56.0