dpaa2_io_create() registers a work handler for the receive dynamic interrupt moderation (INIT_WORK(&obj->rx_dim.work, dpaa2_io_dim_work)). When adaptive RX coalescing is enabled, the receive path calls dpaa2_io_update_net_dim(), and net_dim() schedules rx_dim.work on the system workqueue whenever the moderation profile changes. The worker recovers the owning dpaa2_io with container_of() and programs the interrupt coalescing through d->swp. dpaa2_io_down() removes the object from the service list and frees it without waiting for this work, so a moderation update that is still pending or running when the DPIO device is removed dereferences freed memory. Fix this by cancelling rx_dim.work in dpaa2_io_down() before the object is freed, so a pending or running moderation update finishes while the dpaa2_io it dereferences is still alive. This issue was found by an in-house static analysis tool. Fixes: 69651bd8d303 ("soc: fsl: dpio: add Net DIM integration") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu --- drivers/soc/fsl/dpio/dpio-service.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/soc/fsl/dpio/dpio-service.c b/drivers/soc/fsl/dpio/dpio-service.c index 317ca50b0c2b..1ea185f8a4bd 100644 --- a/drivers/soc/fsl/dpio/dpio-service.c +++ b/drivers/soc/fsl/dpio/dpio-service.c @@ -205,6 +205,8 @@ struct dpaa2_io *dpaa2_io_create(const struct dpaa2_io_desc *desc, */ void dpaa2_io_down(struct dpaa2_io *d) { + cancel_work_sync(&d->rx_dim.work); + spin_lock(&dpio_list_lock); dpio_by_cpu[d->dpio_desc.cpu] = NULL; list_del(&d->node); -- 2.34.1