linux-kernel - [PATCH net v3 3/4] net: dsa: microchip: Ensure a ksz

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251114-ksz-fix-v3-3-acbb3b9cc32f@bootlin.com>
Date: Fri, 14 Nov 2025 08:20:22 +0100
From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@...tlin.com>
To: Woojung Huh <woojung.huh@...rochip.com>, UNGLinuxDriver@...rochip.com, 
 Andrew Lunn <andrew@...n.ch>, Vladimir Oltean <olteanv@...il.com>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Richard Cochran <richardcochran@...il.com>, 
 Arun Ramadoss <arun.ramadoss@...rochip.com>
Cc: Pascal Eberhard <pascal.eberhard@...com>, 
 Miquèl Raynal <miquel.raynal@...tlin.com>, 
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, 
 "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@...tlin.com>
Subject: [PATCH net v3 3/4] net: dsa: microchip: Ensure a ksz_irq is
 initialized before freeing it

Sometimes ksz_irq_free() can be called on uninitialized ksz_irq (for
example when ksz_ptp_irq_setup() fails). It leads to freeing
uninitialized IRQ numbers and/or domains.

Ensure that IRQ numbers or domains aren't null before freeing them.
In our case the IRQ number of an initialized ksz_irq is never 0. Indeed,
it's either the device's IRQ number and we enter the IRQ setup only when
this dev->irq is strictly positive, or a virtual IRQ assigned with
irq_create_mapping() which returns strictly positive IRQ numbers.

Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@...tlin.com>
--
Regarding the Fixes tag here, IMO before cc13ab18b201 it was safe to
not check the domain and the IRQ number because I don't see any path
where ksz_irq_free() would be called on a non-initialized ksz_irq
---
 drivers/net/dsa/microchip/ksz_common.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index 3a4516d32aa5f99109853ed400e64f8f7e2d8016..c5f8821a3a0ab7b50ddc31cc0a2f28220fe57c84 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -2858,14 +2858,17 @@ static void ksz_irq_free(struct ksz_irq *kirq)
 {
 	int irq, virq;

-	free_irq(kirq->irq_num, kirq);
+	if (kirq->irq_num)
+		free_irq(kirq->irq_num, kirq);

-	for (irq = 0; irq < kirq->nirqs; irq++) {
-		virq = irq_find_mapping(kirq->domain, irq);
-		irq_dispose_mapping(virq);
-	}
+	if (kirq->domain) {
+		for (irq = 0; irq < kirq->nirqs; irq++) {
+			virq = irq_find_mapping(kirq->domain, irq);
+			irq_dispose_mapping(virq);
+		}

-	irq_domain_remove(kirq->domain);
+		irq_domain_remove(kirq->domain);
+	}
 }

 static irqreturn_t ksz_irq_thread_fn(int irq, void *dev_id)

-- 
2.51.1