]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
iavf: fix PTP use-after-free during reset
authorPetr Oros <poros@redhat.com>
Thu, 29 Jan 2026 09:57:23 +0000 (10:57 +0100)
committerTony Nguyen <anthony.l.nguyen@intel.com>
Tue, 10 Mar 2026 16:08:31 +0000 (09:08 -0700)
commitefc54fb13d79117a825fef17364315a58682c7ec
treeaa0e9a81d3d8f0e35c80498fdcc8eebd5fc1bcea
parentbd98c6204d1195973b1760fe45860863deb6200c
iavf: fix PTP use-after-free during reset

Commit 7c01dbfc8a1c5f ("iavf: periodically cache PHC time") introduced a
worker to cache PHC time, but failed to stop it during reset or disable.

This creates a race condition where `iavf_reset_task()` or
`iavf_disable_vf()` free adapter resources (AQ) while the worker is still
running. If the worker triggers `iavf_queue_ptp_cmd()` during teardown, it
accesses freed memory/locks, leading to a crash.

Fix this by calling `iavf_ptp_release()` before tearing down the adapter.
This ensures `ptp_clock_unregister()` synchronously cancels the worker and
cleans up the chardev before the backing resources are destroyed.

Fixes: 7c01dbfc8a1c5f ("iavf: periodically cache PHC time")
Signed-off-by: Petr Oros <poros@redhat.com>
Reviewed-by: Ivan Vecera <ivecera@redhat.com>
Acked-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
drivers/net/ethernet/intel/iavf/iavf_main.c