linux-kernel - Re: [PATCH net v4 4/5] net: dsa: microchip: Free previously initialized ports on init failures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fed4309a-af05-4222-b9af-2ff8c655f3df@bootlin.com>
Date: Mon, 17 Nov 2025 17:28:54 +0100
From: Maxime Chevallier <maxime.chevallier@...tlin.com>
To: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@...tlin.com>,
 Woojung Huh <woojung.huh@...rochip.com>, UNGLinuxDriver@...rochip.com,
 Andrew Lunn <andrew@...n.ch>, Vladimir Oltean <olteanv@...il.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 Richard Cochran <richardcochran@...il.com>,
 Arun Ramadoss <arun.ramadoss@...rochip.com>
Cc: Pascal Eberhard <pascal.eberhard@...com>,
 Miquèl Raynal <miquel.raynal@...tlin.com>,
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH net v4 4/5] net: dsa: microchip: Free previously
 initialized ports on init failures

Hi Bastien,

On 17/11/2025 14:05, Bastien Curutchet (Schneider Electric) wrote:
> If ksz_pirq_setup() fails after at least one successful port
> initialization, the goto jumps directly to the global irq freeing,
> leaking the resources of the previously initialized ports.
> 
> Fix the goto jump to release all the potentially initialized ports.
> Remove the no-longer used out_girq label.
> 
> Fixes: c9cd961c0d43 ("net: dsa: microchip: lan937x: add interrupt support for port phy link")
> Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@...tlin.com>
> ---
>  drivers/net/dsa/microchip/ksz_common.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
> index a622416d966330187ee062b2f44051ddf4ce2a78..2b6f7abea00776fafff0c1774cab297a7ef261da 100644
> --- a/drivers/net/dsa/microchip/ksz_common.c
> +++ b/drivers/net/dsa/microchip/ksz_common.c
> @@ -3035,7 +3035,7 @@ static int ksz_setup(struct dsa_switch *ds)
>  		dsa_switch_for_each_user_port(dp, dev->ds) {
>  			ret = ksz_pirq_setup(dev, dp->index);
>  			if (ret)
> -				goto out_girq;
> +				goto out_pirq;
>  
>  			if (dev->info->ptp_capable) {
>  				ret = ksz_ptp_irq_setup(ds, dp->index);
> @@ -3083,10 +3083,8 @@ static int ksz_setup(struct dsa_switch *ds)
>  			if (dev->ports[dp->index].pirq.domain)
>  				ksz_irq_free(&dev->ports[dp->index].pirq);
>  		}
> -	}
> -out_girq:
> -	if (dev->irq > 0)
>  		ksz_irq_free(&dev->girq);
> +	}
>  
>  	return ret;
>  }
> 

Looking at the code, I think it's still not enough, but feel free
to correct me.

In ksz_setup(), in one single loop we do :

dsa_switch_for_each_user_port(dp, dev->ds) {
	ksz_pirq_setup();

	ksz_ptp_irq_setup();
}

However when anything fails in the above loop, we jump straight
to out_pirq, which doesn't clean the ptpirq :(

Maxime