The software free queue is shared by both Ethernet ports, but each child removal tears it down. The parent removal then tears it down once more. This can destroy the queue while the sibling port is active and can free it repeatedly. Depopulate both port devices before cleaning up the queue, and perform that cleanup only from the parent. Disable the free-queue interrupt after the managed handlers have drained, since its threaded handler can re-enable it. Guard cleanup for probe and removal paths where no queue was allocated. Fixes: 4d5ae32f5e1e ("net: ethernet: Add a driver for Gemini gigabit ethernet") Reported-by: Myeonghun Pak Resolves: https://lore.kernel.org/netdev/20260917192835.58126-1-mhun512@gmail.com/ Assisted-by: LLM Signed-off-by: Linus Walleij --- drivers/net/ethernet/cortina/gemini.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/cortina/gemini.c b/drivers/net/ethernet/cortina/gemini.c index 2fe7fd0202d2..31bcd41c17fa 100644 --- a/drivers/net/ethernet/cortina/gemini.c +++ b/drivers/net/ethernet/cortina/gemini.c @@ -1004,6 +1004,9 @@ static void geth_cleanup_freeq(struct gemini_ethernet *geth) unsigned int pages = len >> fpp_order; unsigned int pn; + if (!geth->freeq_ring) + return; + writew(readw(geth->base + GLOBAL_SWFQ_RWPTR_REG), geth->base + GLOBAL_SWFQ_RWPTR_REG + 2); writel(0, geth->base + GLOBAL_SW_FREEQ_BASE_SIZE_REG); @@ -2391,7 +2394,6 @@ static void gemini_port_remove(struct gemini_ethernet_port *port) unregister_netdev(port->netdev); } clk_disable_unprepare(port->pclk); - geth_cleanup_freeq(port->geth); } static void gemini_ethernet_init(struct gemini_ethernet *geth) @@ -2683,6 +2685,8 @@ static void gemini_ethernet_remove(struct platform_device *pdev) { struct gemini_ethernet *geth = platform_get_drvdata(pdev); + devm_of_platform_depopulate(&pdev->dev); + writel(0, geth->base + GLOBAL_INTERRUPT_ENABLE_4_REG); geth_cleanup_freeq(geth); geth->initialized = false; } -- 2.55.0