hinic3_nic_probe() registers the NIC event callback with hinic3_adev_event_register(). All probe failure paths unregister the callback before returning. The normal removal path, however, tears down and frees the NIC device without calling hinic3_adev_event_unregister(), leaving the auxiliary device event callback pointing to hinic3_nic_event(). If an event is delivered after the NIC private data has been released, the callback may dereference the freed nic_dev and netdev objects. Unregister the NIC event callback before starting the device teardown. This issue was found by manual code inspection. Fixes: 17fcb3dc12bb ("hinic3: module initialization and tx/rx logic") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/net/ethernet/huawei/hinic3/hinic3_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c index 0a888fe4c975..42e2ad179a9f 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_main.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_main.c @@ -499,6 +499,8 @@ static void hinic3_nic_remove(struct auxiliary_device *adev) if (!hinic3_support_nic(nic_dev->hwdev)) return; + hinic3_adev_event_unregister(adev); + netdev = nic_dev->netdev; unregister_netdev(netdev); -- 2.43.0