This series incorporates Miquel Raynal's disable_work_sync() suggestion and separately fixes the registration-failure path.
Patch 1 fixes the removal path: the FIFOP IRQ can re-queue RX work after cc2520_remove() flushes it, so the work may run after the private data is freed. Disable the work with disable_work_sync() and destroy the buffer mutex last. Patch 2 fixes a registration failure: with the FIFOP interrupt requested before cc2520_register(), a failed registration could leave the mac802154 RX tasklet scheduled across ieee802154_free_hw(). Request the FIFOP interrupt after registration (and the SFD interrupt before it). Changes in v3: - Split into two fixes (removal path, registration failure), per Miquel Raynal's review of v2. Changes in v2: - Use disable_work_sync() for the FIFOP work instead of explicitly freeing the interrupts, as suggested by Miquel Raynal. Fan Wu (2): ieee802154: cc2520: fix FIFOP work use-after-free ieee802154: cc2520: fix RX tasklet use-after-free drivers/net/ieee802154/cc2520.c | 43 +++++++++++++++++---------------- 1 file changed, 22 insertions(+), 21 deletions(-) -- 2.34.1
