fec_drv_remove() unregisters the PTP clock before unregistering the netdev. A concurrent ethtool -T can therefore pass a freed PTP clock to ptp_clock_index() through fec_enet_get_ts_info(). Move fec_ptp_stop() after unregister_netdev(), which drains the ethtool callbacks before the PTP clock is torn down. Leave the probe error path unchanged, since the netdev has not been registered there. Fixes: 32cba57ba74b ("net: fec: introduce fec_ptp_stop and use in probe fail path") Cc: stable@vger.kernel.org Suggested-by: Wei Fang Assisted-by: GLM:5.3 Signed-off-by: Shengzhuo Wei --- drivers/net/ethernet/freescale/fec_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 794ec427b0ee..a29c8ddbbf34 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -5500,9 +5500,9 @@ fec_drv_remove(struct platform_device *pdev) ERR_PTR(ret)); cancel_work_sync(&fep->tx_timeout_work); + unregister_netdev(ndev); if (fep->bufdesc_ex) fec_ptp_stop(pdev); - unregister_netdev(ndev); fec_enet_mii_remove(fep); if (fep->reg_phy) regulator_disable(fep->reg_phy); -- 2.47.3