ucc_hdlc_probe() registers an HDLC netdev whose private pointer refers to the separately allocated ucc_hdlc_private object. The remove path frees that object and its resources without unregistering or freeing the netdev. The registered device is left with a dangling private pointer. Unregister the HDLC device before releasing the UCC and DMA resources so an active interface is stopped first. Free the netdev before releasing its private object. This patch depends on the preceding "net: wan: hdlc: close active devices before protocol detach" fix (patch 3 of this series). Without that fix, protocol detach clears IFF_UP before unregister can invoke ndo_stop, so an active interface would not be stopped before its resources are freed. Fixes: c19b6d246a35 ("drivers/net: support hdlc function for QE-UCC") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260803133048.42650-1-mhun512@gmail.com Link: https://lore.kernel.org/r/20260806020541.2011936-2-kuba@kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/net/wan/fsl_ucc_hdlc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c index 596f4ef053636..371150efc1a65 100644 --- a/drivers/net/wan/fsl_ucc_hdlc.c +++ b/drivers/net/wan/fsl_ucc_hdlc.c @@ -1255,6 +1255,8 @@ static void ucc_hdlc_remove(struct platform_device *pdev) { struct ucc_hdlc_private *priv = dev_get_drvdata(&pdev->dev); + unregister_hdlc_device(priv->ndev); + uhdlc_memclean(priv); if (priv->utdm && priv->utdm->si_regs) { @@ -1266,6 +1268,7 @@ static void ucc_hdlc_remove(struct platform_device *pdev) iounmap(priv->utdm->siram); priv->utdm->siram = NULL; } + free_netdev(priv->ndev); kfree(priv); dev_info(&pdev->dev, "UCC based hdlc module removed\n"); -- 2.47.1