Commit e0c16233 authored by Dan Carpenter's avatar Dan Carpenter Committed by Jakub Kicinski
Browse files

net: mscc: ocelot: fix error handling bugs in mscc_ocelot_init_ports() 



There are several error handling bugs in mscc_ocelot_init_ports().  I
went through the code, and carefully audited it and made fixes and
cleanups.

1) The ocelot_probe_port() function didn't have a mirror release function
   so it was hard to follow.  I created the ocelot_release_port()
   function.
2) In the ocelot_probe_port() function, if the register_netdev() call
   failed, then it lead to a double free_netdev(dev) bug.  Fix this by
   setting "ocelot->ports[port] = NULL" on the error path.
3) I was concerned that the "port" which comes from of_property_read_u32()
   might be out of bounds so I added a check for that.
4) In the original code if ocelot_regmap_init() failed then the driver
   tried to continue but I think that should be a fatal error.
5) If ocelot_probe_port() failed then the most recent devlink was leaked.
   The fix for mostly came Vladimir Oltean.  Get rid of "registered_ports"
   and just set a bit in "devlink_ports_registered" to say when the
   devlink port has been registered (and needs to be unregistered on
   error).  There are fewer than 32 ports so a u32 is large enough for
   this purpose.
6) The error handling if the final ocelot_port_devlink_init() failed had
   two problems.  The "while (port-- >= 0)" loop should have been
   "--port" pre-op instead of a post-op to avoid a buffer underflow.
   The "if (!registered_ports[port])" condition was reversed leading to
   resource leaks and double frees.

Fixes: 6c30384e ("net: mscc: ocelot: register devlink ports")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
Tested-by: default avatarVladimir Oltean <vladimir.oltean@nxp.com>
Link: https://lore.kernel.org/r/YBkXhqRxHtRGzSnJ@mwanda


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 2d912da0

drivers/net/ethernet/mscc/ocelot.h

+1 −0
Original line number Diff line number Diff line
@@ -121,6 +121,7 @@ void ocelot_port_writel(struct ocelot_port *port, u32 val, u32 reg); 


int ocelot_probe_port(struct ocelot *ocelot, int port, struct regmap *target,

		      struct phy_device *phy);

void ocelot_release_port(struct ocelot_port *ocelot_port);

int ocelot_devlink_init(struct ocelot *ocelot);

void ocelot_devlink_teardown(struct ocelot *ocelot);

int ocelot_port_devlink_init(struct ocelot *ocelot, int port,

drivers/net/ethernet/mscc/ocelot_net.c

+13 −1
Original line number Diff line number Diff line
@@ -1283,7 +1283,19 @@ int ocelot_probe_port(struct ocelot *ocelot, int port, struct regmap *target, 
	if (err) {

		dev_err(ocelot->dev, "register_netdev failed\n");

		free_netdev(dev);

		ocelot->ports[port] = NULL;

		return err;

	}



	return err;

	return 0;

}



void ocelot_release_port(struct ocelot_port *ocelot_port)

{

	struct ocelot_port_private *priv = container_of(ocelot_port,

						struct ocelot_port_private,

						port);



	unregister_netdev(priv->dev);

	free_netdev(priv->dev);

}

drivers/net/ethernet/mscc/ocelot_vsc7514.c

+19 −33
Original line number Diff line number Diff line
@@ -1064,7 +1064,6 @@ static void mscc_ocelot_release_ports(struct ocelot *ocelot) 
	int port;



	for (port = 0; port < ocelot->num_phys_ports; port++) {

		struct ocelot_port_private *priv;

		struct ocelot_port *ocelot_port;



		ocelot_port = ocelot->ports[port];
@@ -1072,12 +1071,7 @@ static void mscc_ocelot_release_ports(struct ocelot *ocelot) 
			continue;



		ocelot_deinit_port(ocelot, port);



		priv = container_of(ocelot_port, struct ocelot_port_private,

				    port);



		unregister_netdev(priv->dev);

		free_netdev(priv->dev);

		ocelot_release_port(ocelot_port);

	}

}
@@ -1085,8 +1079,8 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
				  struct device_node *ports)

{

	struct ocelot *ocelot = platform_get_drvdata(pdev);

	u32 devlink_ports_registered = 0;

	struct device_node *portnp;

	bool *registered_ports;

	int port, err;

	u32 reg;
@@ -1102,11 +1096,6 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
	if (!ocelot->devlink_ports)

		return -ENOMEM;



	registered_ports = kcalloc(ocelot->num_phys_ports, sizeof(bool),

				   GFP_KERNEL);

	if (!registered_ports)

		return -ENOMEM;



	for_each_available_child_of_node(ports, portnp) {

		struct ocelot_port_private *priv;

		struct ocelot_port *ocelot_port;
@@ -1123,14 +1112,22 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
			continue;



		port = reg;

		if (port < 0 || port >= ocelot->num_phys_ports) {

			dev_err(ocelot->dev,

				"invalid port number: %d >= %d\n", port,

				ocelot->num_phys_ports);

			continue;

		}



		snprintf(res_name, sizeof(res_name), "port%d", port);



		res = platform_get_resource_byname(pdev, IORESOURCE_MEM,

						   res_name);

		target = ocelot_regmap_init(ocelot, res);

		if (IS_ERR(target))

			continue;

		if (IS_ERR(target)) {

			err = PTR_ERR(target);

			goto out_teardown;

		}



		phy_node = of_parse_phandle(portnp, "phy-handle", 0);

		if (!phy_node)
@@ -1147,6 +1144,7 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
			of_node_put(portnp);

			goto out_teardown;

		}

		devlink_ports_registered |= BIT(port);



		err = ocelot_probe_port(ocelot, port, target, phy);

		if (err) {
@@ -1154,8 +1152,6 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
			goto out_teardown;

		}



		registered_ports[port] = true;



		ocelot_port = ocelot->ports[port];

		priv = container_of(ocelot_port, struct ocelot_port_private,

				    port);
@@ -1208,23 +1204,16 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 


	/* Initialize unused devlink ports at the end */

	for (port = 0; port < ocelot->num_phys_ports; port++) {

		if (registered_ports[port])

		if (devlink_ports_registered & BIT(port))

			continue;



		err = ocelot_port_devlink_init(ocelot, port,

					       DEVLINK_PORT_FLAVOUR_UNUSED);

		if (err) {

			while (port-- >= 0) {

				if (!registered_ports[port])

					continue;

				ocelot_port_devlink_teardown(ocelot, port);

			}



		if (err)

			goto out_teardown;

		}

	}



	kfree(registered_ports);

		devlink_ports_registered |= BIT(port);

	}



	return 0;
@@ -1233,12 +1222,9 @@ static int mscc_ocelot_init_ports(struct platform_device *pdev, 
	mscc_ocelot_release_ports(ocelot);

	/* Tear down devlink ports for the registered network interfaces */

	for (port = 0; port < ocelot->num_phys_ports; port++) {

		if (!registered_ports[port])

			continue;



		if (devlink_ports_registered & BIT(port))

			ocelot_port_devlink_teardown(ocelot, port);

	}

	kfree(registered_ports);

	return err;

}