netcons_netpoll_setup() drops RTNL while it waits for carrier when the device is not yet up. If the device is unregistered in that window, the NETDEV_UNREGISTER notifier runs before np->dev is set and has nothing to match. We might then end up setting up netpoll on a device that is being unregistered while holding a reference to it, stalling unregister_netdevice() in netdev_wait_allrefs_any(). Add a check to confirm the device is still registered once we retake RTNL. Release the device reference and return -ENODEV otherwise. Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261012-netcons-fixes-v3-1-1aac85ed7665@gmail.com Signed-off-by: Gustavo Luiz Duarte --- drivers/net/netconsole.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c index be7eb632ee42..bd36ebd334aa 100644 --- a/drivers/net/netconsole.c +++ b/drivers/net/netconsole.c @@ -534,6 +534,16 @@ static int netcons_netpoll_setup(struct netconsole_target *nt) rtnl_unlock(); netcons_wait_carrier(np, ndev); rtnl_lock(); + + /* Check that ndev hasn't been unregistered when we released + * the RTNL above. + */ + if (ndev->reg_state != NETREG_REGISTERED) { + np_err(np, "%s was unregistered while waiting for carrier, aborting\n", + netcons_egress_dev(np, buf, sizeof(buf))); + err = -ENODEV; + goto put; + } } if (netcons_local_ip_unset(nt)) { -- 2.56.0