[lvc-project] [PATCH net v2 1/3] net: fealnx: fix teardown order in remove

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>

fealnx_remove_one() frees the DMA rings before unregistering the
netdev, while the interface may still be up, which leaves a
window where freed memory can be accessed.

Call unregister_netdev() first so dev_close() stops the Tx/Rx
engines, deletes the timers, and frees the IRQ before the rings are
freed.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable at vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev at prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index bdc38aac5850..68194c9ef332 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -682,11 +682,11 @@ static void fealnx_remove_one(struct pci_dev *pdev)
 	if (dev) {
 		struct netdev_private *np = netdev_priv(dev);
 
+		unregister_netdev(dev);
 		dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
 				  np->tx_ring_dma);
 		dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
 				  np->rx_ring_dma);
-		unregister_netdev(dev);
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
-- 
2.53.0