Commit cacddb49 authored by Vladimir Oltean's avatar Vladimir Oltean Committed by Zhengchao Shao
Browse files

net: dsa: seville: register the mdiobus under devres 

mainline inclusion
from mainline-v5.17-rc4
commit bd488afc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IADFY0
CVE: CVE-2022-48814

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bd488afc3b39e045ba71aab472233f2a78726e7b



--------------------------------

As explained in commits:
74b6d7d1 ("net: dsa: realtek: register the MDIO bus under devres")
5135e96a ("net: dsa: don't allocate the slave_mii_bus using devres")

mdiobus_free() will panic when called from devm_mdiobus_free() <-
devres_release_all() <- __device_release_driver(), and that mdiobus was
not previously unregistered.

The Seville VSC9959 switch is a platform device, so the initial set of
constraints that I thought would cause this (I2C or SPI buses which call
->remove on ->shutdown) do not apply. But there is one more which
applies here.

If the DSA master itself is on a bus that calls ->remove from ->shutdown
(like dpaa2-eth, which is on the fsl-mc bus), there is a device link
between the switch and the DSA master, and device_links_unbind_consumers()
will unbind the seville switch driver on shutdown.

So the same treatment must be applied to all DSA switch drivers, which
is: either use devres for both the mdiobus allocation and registration,
or don't use devres at all.

The seville driver has a code structure that could accommodate both the
mdiobus_unregister and mdiobus_free calls, but it has an external
dependency upon mscc_miim_setup() from mdio-mscc-miim.c, which calls
devm_mdiobus_alloc_size() on its behalf. So rather than restructuring
that, and exporting yet one more symbol mscc_miim_teardown(), let's work
with devres and replace of_mdiobus_register with the devres variant.
When we use all-devres, we can ensure that devres doesn't free a
still-registered bus (it either runs both callbacks, or none).

Fixes: ac3a68d5 ("net: phy: don't abuse devres in devm_mdiobus_register()")
Signed-off-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>

Conflicts:
	drivers/net/dsa/ocelot/seville_vsc9953.c
[The conflict occurs because the commit 5186c4a0("net: dsa: ocelot:
seville: utilize of_mdiobus_register") is not merged]
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent ed16c732

drivers/net/dsa/ocelot/seville_vsc9953.c

+3 −2
Original line number Diff line number Diff line
@@ -1092,7 +1092,7 @@ static int vsc9953_mdio_bus_alloc(struct ocelot *ocelot) 
	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-imdio", dev_name(dev));



	/* Needed in order to initialize the bus mutex lock */

	rc = mdiobus_register(bus);

	rc = devm_mdiobus_register(dev, bus);

	if (rc < 0) {

		dev_err(dev, "failed to register MDIO bus\n");

		return rc;
@@ -1144,7 +1144,8 @@ static void vsc9953_mdio_bus_free(struct ocelot *ocelot) 
		mdio_device_free(pcs->mdio);

		lynx_pcs_destroy(pcs);

	}

	mdiobus_unregister(felix->imdio);



	 /* mdiobus_unregister and mdiobus_free handled by devres */

}



static void vsc9953_xmit_template_populate(struct ocelot *ocelot, int port)