linux-kernel - [PATCH net v4 3/5] net: dsa: microchip: Ensure a ksz

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251117-ksz-fix-v4-3-13e1da58a492@bootlin.com>
Date: Mon, 17 Nov 2025 14:05:44 +0100
From: "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@...tlin.com>
To: Woojung Huh <woojung.huh@...rochip.com>, UNGLinuxDriver@...rochip.com, 
 Andrew Lunn <andrew@...n.ch>, Vladimir Oltean <olteanv@...il.com>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Richard Cochran <richardcochran@...il.com>, 
 Arun Ramadoss <arun.ramadoss@...rochip.com>
Cc: Pascal Eberhard <pascal.eberhard@...com>, 
 Miquèl Raynal <miquel.raynal@...tlin.com>, 
 Thomas Petazzoni <thomas.petazzoni@...tlin.com>, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, 
 "Bastien Curutchet (Schneider Electric)" <bastien.curutchet@...tlin.com>
Subject: [PATCH net v4 3/5] net: dsa: microchip: Ensure a ksz_irq is
 initialized before freeing it

If something goes wrong at setup, ksz_irq_free() can be called on
uninitialized ksz_irq (for example when ksz_ptp_irq_setup() fails). It
leads to freeing uninitialized IRQ numbers and/or domains.

Ensure that the ksz_irq is initialized before calling ksz_irq_free().

Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@...tlin.com>
--
Regarding the Fixes tag here, IMO before cc13ab18b201 it was safe to
not check the domain and the IRQ number because I don't see any path
where ksz_irq_free() would be called on a non-initialized ksz_irq
---
 drivers/net/dsa/microchip/ksz_common.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
index c724f5af5d98bf3ff784e36393dd5b3fa7b37c13..a622416d966330187ee062b2f44051ddf4ce2a78 100644
--- a/drivers/net/dsa/microchip/ksz_common.c
+++ b/drivers/net/dsa/microchip/ksz_common.c
@@ -3078,9 +3078,12 @@ static int ksz_setup(struct dsa_switch *ds)
 		dsa_switch_for_each_user_port(dp, dev->ds)
 			ksz_ptp_irq_free(ds, dp->index);
 out_pirq:
-	if (dev->irq > 0)
-		dsa_switch_for_each_user_port(dp, dev->ds)
-			ksz_irq_free(&dev->ports[dp->index].pirq);
+	if (dev->irq > 0) {
+		dsa_switch_for_each_user_port(dp, dev->ds) {
+			if (dev->ports[dp->index].pirq.domain)
+				ksz_irq_free(&dev->ports[dp->index].pirq);
+		}
+	}
 out_girq:
 	if (dev->irq > 0)
 		ksz_irq_free(&dev->girq);

-- 
2.51.1