linux-kernel - Re: [PATCH net-next v6 7/9] net: dsa: microchip: Add error handling for ksz_switch_macaddr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231019171916.nu4aptbxl6owg2gi@skbuf>
Date:   Thu, 19 Oct 2023 20:19:16 +0300
From:   Vladimir Oltean <olteanv@...il.com>
To:     Oleksij Rempel <o.rempel@...gutronix.de>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Andrew Lunn <andrew@...n.ch>,
        Eric Dumazet <edumazet@...gle.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Woojung Huh <woojung.huh@...rochip.com>,
        Arun Ramadoss <arun.ramadoss@...rochip.com>,
        Conor Dooley <conor+dt@...nel.org>,
        Krzysztof Kozlowski <krzysztof.kozlowski+dt@...aro.org>,
        Rob Herring <robh+dt@...nel.org>,
        Florian Fainelli <florian.fainelli@...adcom.com>,
        kernel@...gutronix.de, linux-kernel@...r.kernel.org,
        netdev@...r.kernel.org, UNGLinuxDriver@...rochip.com,
        "Russell King (Oracle)" <linux@...linux.org.uk>,
        devicetree@...r.kernel.org
Subject: Re: [PATCH net-next v6 7/9] net: dsa: microchip: Add error handling
 for ksz_switch_macaddr_get()

On Thu, Oct 19, 2023 at 08:13:08PM +0300, Vladimir Oltean wrote:
> On Thu, Oct 19, 2023 at 02:28:48PM +0200, Oleksij Rempel wrote:
> > Enhance the ksz_switch_macaddr_get() function to handle errors that may
> > occur during the call to ksz_write8(). Specifically, this update checks
> > the return value of ksz_write8(), which may fail if regmap ranges
> > validation is not passed and returns the error code.
> > 
> > Signed-off-by: Oleksij Rempel <o.rempel@...gutronix.de>
> > Reviewed-by: Andrew Lunn <andrew@...n.ch>
> > Reviewed-by: Florian Fainelli <florian.fainelli@...adcom.com>
> > ---
> >  drivers/net/dsa/microchip/ksz_common.c | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
> > index 7b05de6fe987..79052a54880c 100644
> > --- a/drivers/net/dsa/microchip/ksz_common.c
> > +++ b/drivers/net/dsa/microchip/ksz_common.c
> > @@ -3612,7 +3612,7 @@ int ksz_switch_macaddr_get(struct dsa_switch *ds, int port,
> >  	struct ksz_switch_macaddr *switch_macaddr;
> >  	struct ksz_device *dev = ds->priv;
> >  	const u16 *regs = dev->info->regs;
> > -	int i;
> > +	int i, ret;
> >  
> >  	/* Make sure concurrent MAC address changes are blocked */
> >  	ASSERT_RTNL();
> > @@ -3639,8 +3639,11 @@ int ksz_switch_macaddr_get(struct dsa_switch *ds, int port,
> >  	dev->switch_macaddr = switch_macaddr;
> >  
> >  	/* Program the switch MAC address to hardware */
> > -	for (i = 0; i < ETH_ALEN; i++)
> > -		ksz_write8(dev, regs[REG_SW_MAC_ADDR] + i, addr[i]);
> > +	for (i = 0; i < ETH_ALEN; i++) {
> > +		ret = ksz_write8(dev, regs[REG_SW_MAC_ADDR] + i, addr[i]);
> > +		if (ret)
> > +			return ret;
> > +	}
> 
> I understand that you intend the error to be fatal, but this leaks memory and a refcount.

I didn't estimate correctly what would happen.

If ksz_write8() fails as you say, we will leave behind the reference to
dev->switch_macaddr, which points to valid memory. Which means that the
second time around, the call to ksz_switch_macaddr_get() will succeed,
because the driver thinks that the address has been programmed to
hardware, and it is unaware of the previous failure. But it will not
work. Am I correct?

If so, it needs to tear down properly, because if ksz_switch_macaddr_get()
fails once to write to hardware, it should fail always.