@@ -1599,7 +1599,7 @@ static int ftgmac100_stop(struct net_device *netdev)
netif_napi_del(&priv->napi);
if (netdev->phydev)
phy_stop(netdev->phydev);
- if (priv->use_ncsi)
+ if (priv->ndev)
ncsi_stop_dev(priv->ndev);
ftgmac100_stop_hw(priv);
@@ -2059,8 +2059,10 @@ static void ftgmac100_remove(struct platform_device *pdev)
netdev = platform_get_drvdata(pdev);
priv = netdev_priv(netdev);
- if (priv->ndev)
+ if (priv->ndev) {
ncsi_unregister_dev(priv->ndev);
+ priv->ndev = NULL;
+ }
unregister_netdev(netdev);
clk_disable_unprepare(priv->rclk);
When removing an active ftgmac100 netdev that is configured for NCSI, we have a double free of the ncsi device: We currently unregister the ncsi device (freeing it), then unregister the netdev itself. If the netdev is running, the netdev_unregister() path performs a ->ndo_stop(), which calls ncsi_stop_dev() on the now-free ncsi pointer. Instead, modify ftgmac100_stop() to check the ncsi pointer before freeing (rather than use_ncsi, which reflects configuration intent), and clear the pointer once we have done the ncsi_unregister(). Fixes: 3d5179458d22 ("net: ftgmac100: Fix crash when removing driver") Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> --- drivers/net/ethernet/faraday/ftgmac100.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)