Make sure to disable and deregister the switch on late probe errors to avoid use-after-free when the device-resource-managed switch is freed.
Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Cc: stable stable@vger.kernel.org # 4.20 Cc: Hauke Mehrtens hauke@hauke-m.de Signed-off-by: Johan Hovold johan@kernel.org --- drivers/net/dsa/lantiq_gswip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c index 693a67f45bef..b06c41c98de9 100644 --- a/drivers/net/dsa/lantiq_gswip.c +++ b/drivers/net/dsa/lantiq_gswip.c @@ -1099,7 +1099,7 @@ static int gswip_probe(struct platform_device *pdev) dev_err(dev, "wrong CPU port defined, HW only supports port: %i", priv->hw_info->cpu_port); err = -EINVAL; - goto mdio_bus; + goto disable_switch; }
platform_set_drvdata(pdev, priv); @@ -1109,6 +1109,9 @@ static int gswip_probe(struct platform_device *pdev) (version & GSWIP_VERSION_MOD_MASK) >> GSWIP_VERSION_MOD_SHIFT); return 0;
+disable_switch: + gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB); + dsa_unregister_switch(priv->ds); mdio_bus: if (mdio_np) mdiobus_unregister(priv->ds->slave_mii_bus);
On Wed, Jan 16, 2019 at 11:23:33AM +0100, Johan Hovold wrote:
Make sure to disable and deregister the switch on late probe errors to avoid use-after-free when the device-resource-managed switch is freed.
Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Cc: stable stable@vger.kernel.org # 4.20 Cc: Hauke Mehrtens hauke@hauke-m.de Signed-off-by: Johan Hovold johan@kernel.org
drivers/net/dsa/lantiq_gswip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c index 693a67f45bef..b06c41c98de9 100644 --- a/drivers/net/dsa/lantiq_gswip.c +++ b/drivers/net/dsa/lantiq_gswip.c @@ -1099,7 +1099,7 @@ static int gswip_probe(struct platform_device *pdev) dev_err(dev, "wrong CPU port defined, HW only supports port: %i", priv->hw_info->cpu_port); err = -EINVAL;
goto mdio_bus;
goto disable_switch;platform_set_drvdata(pdev, priv); @@ -1109,6 +1109,9 @@ static int gswip_probe(struct platform_device *pdev) (version & GSWIP_VERSION_MOD_MASK) >> GSWIP_VERSION_MOD_SHIFT); return 0; +disable_switch:
- gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB);
- dsa_unregister_switch(priv->ds);
This is correct. But it would be nice if somebody in the future could move the disabling of the switch to the inverse of the gswip_setup() function to make the code symmetrical.
Reviewed-by: Andrew Lunn andrew@lunn.ch
Andrew
On 1/16/19 4:00 PM, Andrew Lunn wrote:
On Wed, Jan 16, 2019 at 11:23:33AM +0100, Johan Hovold wrote:
Make sure to disable and deregister the switch on late probe errors to avoid use-after-free when the device-resource-managed switch is freed.
Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Cc: stable stable@vger.kernel.org # 4.20 Cc: Hauke Mehrtens hauke@hauke-m.de Signed-off-by: Johan Hovold johan@kernel.org
drivers/net/dsa/lantiq_gswip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c index 693a67f45bef..b06c41c98de9 100644 --- a/drivers/net/dsa/lantiq_gswip.c +++ b/drivers/net/dsa/lantiq_gswip.c @@ -1099,7 +1099,7 @@ static int gswip_probe(struct platform_device *pdev) dev_err(dev, "wrong CPU port defined, HW only supports port: %i", priv->hw_info->cpu_port); err = -EINVAL;
goto mdio_bus;
goto disable_switch;platform_set_drvdata(pdev, priv); @@ -1109,6 +1109,9 @@ static int gswip_probe(struct platform_device *pdev) (version & GSWIP_VERSION_MOD_MASK) >> GSWIP_VERSION_MOD_SHIFT); return 0; +disable_switch:
- gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB);
- dsa_unregister_switch(priv->ds);
This is correct. But it would be nice if somebody in the future could move the disabling of the switch to the inverse of the gswip_setup() function to make the code symmetrical.
Should we add an uninit callback?
Hauke
This is correct. But it would be nice if somebody in the future could move the disabling of the switch to the inverse of the gswip_setup() function to make the code symmetrical.
Should we add an uninit callback?
Yes, that would be good.
It looks like lan9303-core.c could use it as well for lan9303_disable_processing(chip);
Thanks Andrew
On 1/16/19 11:23 AM, Johan Hovold wrote:
Make sure to disable and deregister the switch on late probe errors to avoid use-after-free when the device-resource-managed switch is freed.
Fixes: 14fceff4771e ("net: dsa: Add Lantiq / Intel DSA driver for vrx200") Cc: stable stable@vger.kernel.org # 4.20 Cc: Hauke Mehrtens hauke@hauke-m.de Signed-off-by: Johan Hovold johan@kernel.org
Acked-by: Hauke Mehrtens hauke@hauke-m.de
drivers/net/dsa/lantiq_gswip.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/dsa/lantiq_gswip.c b/drivers/net/dsa/lantiq_gswip.c index 693a67f45bef..b06c41c98de9 100644 --- a/drivers/net/dsa/lantiq_gswip.c +++ b/drivers/net/dsa/lantiq_gswip.c @@ -1099,7 +1099,7 @@ static int gswip_probe(struct platform_device *pdev) dev_err(dev, "wrong CPU port defined, HW only supports port: %i", priv->hw_info->cpu_port); err = -EINVAL;
goto mdio_bus;
goto disable_switch;platform_set_drvdata(pdev, priv); @@ -1109,6 +1109,9 @@ static int gswip_probe(struct platform_device *pdev) (version & GSWIP_VERSION_MOD_MASK) >> GSWIP_VERSION_MOD_SHIFT); return 0; +disable_switch:
- gswip_mdio_mask(priv, GSWIP_MDIO_GLOB_ENABLE, 0, GSWIP_MDIO_GLOB);
- dsa_unregister_switch(priv->ds);
mdio_bus: if (mdio_np) mdiobus_unregister(priv->ds->slave_mii_bus);
linux-stable-mirror@lists.linaro.org
-
Andrew Lunn -
Hauke Mehrtens -
Johan Hovold