In __stmmac_open() and stmmac_xdp_open(), the DMA engine is started before stmmac_request_irq() is called. If the IRQ request fails, the clean-up paths free the DMA descriptor rings via dma_free_coherent() without stopping the DMA engine first. With the DMA engine still running, hardware may continue to access the descriptor ring memory after it has been freed. Add stmmac_stop_all_dma() to both error paths, matching the teardown order in __stmmac_release(). Fixes: 8532f613bc78b ("net: stmmac: introduce MSI Interrupt routines for mac, safety, RX & TX") Signed-off-by: ZhaoJinming --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index b2b7d0242dd3..f76d762c314c 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4176,6 +4176,8 @@ static int __stmmac_open(struct net_device *dev, irq_error: phylink_stop(priv->phylink); + stmmac_stop_all_dma(priv); + for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer); @@ -7203,6 +7205,8 @@ int stmmac_xdp_open(struct net_device *dev) return 0; irq_error: + stmmac_stop_all_dma(priv); + for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) hrtimer_cancel(&priv->dma_conf.tx_queue[chan].txtimer); -- 2.51.0