netdev - Re: [PATCH net-next v6 7/9] net: dsa: microchip: Add error handling for ksz_switch_macaddr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231019171916.nu4aptbxl6owg2gi@skbuf>
Date: Thu, 19 Oct 2023 20:19:16 +0300
From: Vladimir Oltean <olteanv@...il.com>
To: Oleksij Rempel <o.rempel@...gutronix.de>
Cc: "David S. Miller" <davem@...emloft.net>, Andrew Lunn <andrew@...n.ch>,
	Eric Dumazet <edumazet@...gle.com>,
	Florian Fainelli <f.fainelli@...il.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Woojung Huh <woojung.huh@...rochip.com>,
	Arun Ramadoss <arun.ramadoss@...rochip.com>,
	Conor Dooley <conor+dt@...nel.org>,
	Krzysztof Kozlowski <krzysztof.kozlowski+dt@...aro.org>,
	Rob Herring <robh+dt@...nel.org>,
	Florian Fainelli <florian.fainelli@...adcom.com>,
	kernel@...gutronix.de, linux-kernel@...r.kernel.org,
	netdev@...r.kernel.org, UNGLinuxDriver@...rochip.com,
	"Russell King (Oracle)" <linux@...linux.org.uk>,
	devicetree@...r.kernel.org
Subject: Re: [PATCH net-next v6 7/9] net: dsa: microchip: Add error handling
 for ksz_switch_macaddr_get()

On Thu, Oct 19, 2023 at 08:13:08PM +0300, Vladimir Oltean wrote:
> On Thu, Oct 19, 2023 at 02:28:48PM +0200, Oleksij Rempel wrote:
> > Enhance the ksz_switch_macaddr_get() function to handle errors that may
> > occur during the call to ksz_write8(). Specifically, this update checks
> > the return value of ksz_write8(), which may fail if regmap ranges
> > validation is not passed and returns the error code.
> > 
> > Signed-off-by: Oleksij Rempel <o.rempel@...gutronix.de>
> > Reviewed-by: Andrew Lunn <andrew@...n.ch>
> > Reviewed-by: Florian Fainelli <florian.fainelli@...adcom.com>
> > ---
> >  drivers/net/dsa/microchip/ksz_common.c | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> > 
> > diff --git a/drivers/net/dsa/microchip/ksz_common.c b/drivers/net/dsa/microchip/ksz_common.c
> > index 7b05de6fe987..79052a54880c 100644
> > --- a/drivers/net/dsa/microchip/ksz_common.c
> > +++ b/drivers/net/dsa/microchip/ksz_common.c
> > @@ -3612,7 +3612,7 @@ int ksz_switch_macaddr_get(struct dsa_switch *ds, int port,
> >  	struct ksz_switch_macaddr *switch_macaddr;
> >  	struct ksz_device *dev = ds->priv;
> >  	const u16 *regs = dev->info->regs;
> > -	int i;
> > +	int i, ret;
> >  
> >  	/* Make sure concurrent MAC address changes are blocked */
> >  	ASSERT_RTNL();
> > @@ -3639,8 +3639,11 @@ int ksz_switch_macaddr_get(struct dsa_switch *ds, int port,
> >  	dev->switch_macaddr = switch_macaddr;
> >  
> >  	/* Program the switch MAC address to hardware */
> > -	for (i = 0; i < ETH_ALEN; i++)
> > -		ksz_write8(dev, regs[REG_SW_MAC_ADDR] + i, addr[i]);
> > +	for (i = 0; i < ETH_ALEN; i++) {
> > +		ret = ksz_write8(dev, regs[REG_SW_MAC_ADDR] + i, addr[i]);
> > +		if (ret)
> > +			return ret;
> > +	}
> 
> I understand that you intend the error to be fatal, but this leaks memory and a refcount.

I didn't estimate correctly what would happen.

If ksz_write8() fails as you say, we will leave behind the reference to
dev->switch_macaddr, which points to valid memory. Which means that the
second time around, the call to ksz_switch_macaddr_get() will succeed,
because the driver thinks that the address has been programmed to
hardware, and it is unaware of the previous failure. But it will not
work. Am I correct?

If so, it needs to tear down properly, because if ksz_switch_macaddr_get()
fails once to write to hardware, it should fail always.