[PATCH net] dpaa2-switch: fix port cleanup on probe errors

[PATCH net] dpaa2-switch: fix port cleanup on probe errors

[Jaeyeong Lee]

dpaa2_switch_probe() reuses i while probing ports, adding NAPI
instances, registering netdevs, and unwinding failures. Consequently,
the value reaching the port removal loop does not always represent the
number of successfully probed ports.

If IRQ setup fails, i is left equal to DPAA2_SWITCH_RX_NUM_FQS. A
switch with one interface then causes the unwind path to access
ports[1] out of bounds, while a switch with more than two interfaces
leaks all ports after ports[1].

If register_netdev() fails, the unregister loop consumes i down to -1.
The following port removal loop is therefore skipped, leaking every
port netdev and its MAC endpoint reference. The NAPI instances attached
to port 0 also remain linked while their enclosing ethsw is freed.

The issue was discovered by a static analysis tool and confirmed by
manually tracing the probe error paths.

Track successfully probed and registered ports independently. On
post-NAPI failures, unregister only successfully registered netdevs,
delete the NAPI instances, and then remove every successfully probed
port.

Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface")
Cc: stable@vger.kernel.org
Signed-off-by: Jaeyeong Lee <lee@jaeyeong.cc>
---
 .../ethernet/freescale/dpaa2/dpaa2-switch.c    | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
index fe8ac5e85259..0d80706ac41f 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c
@@ -4086,6 +4086,8 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev)
 {
 	struct device *dev = &sw_dev->dev;
 	struct ethsw_core *ethsw;
+	int registered_ports = 0;
+	int probed_ports = 0;
 	int i, err;
 
 	/* Allocate switch core*/
@@ -4148,7 +4150,8 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev)
 	for (i = 0; i < ethsw->sw_attr.num_ifs; i++) {
 		err = dpaa2_switch_probe_port(ethsw, i);
 		if (err)
-			goto err_free_netdev;
+			goto err_remove_ports;
+		probed_ports++;
 	}
 
 	/* Add a NAPI instance for each of the Rx queues. The first port's
@@ -4178,19 +4181,22 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev)
 			dev_err(dev, "register_netdev error %d\n", err);
 			goto err_unregister_ports;
 		}
+		registered_ports++;
 	}
 
 	return 0;
 
 err_unregister_ports:
-	for (i--; i >= 0; i--)
-		unregister_netdev(ethsw->ports[i]->netdev);
+	while (registered_ports)
+		unregister_netdev(ethsw->ports[--registered_ports]->netdev);
 	dpaa2_switch_teardown_irqs(sw_dev);
 err_stop:
 	dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle);
-err_free_netdev:
-	for (i--; i >= 0; i--)
-		dpaa2_switch_remove_port(ethsw, i);
+	for (i = 0; i < DPAA2_SWITCH_RX_NUM_FQS; i++)
+		netif_napi_del(&ethsw->fq[i].napi);
+err_remove_ports:
+	while (probed_ports)
+		dpaa2_switch_remove_port(ethsw, --probed_ports);
 	for (i = 0; i < ethsw->sw_attr.num_ifs; i++)
 		mutex_destroy(&ethsw->lags[i].fdb_lock);
 	kfree(ethsw->lags);
-- 
2.43.0

Re: [PATCH net] dpaa2-switch: fix port cleanup on probe errors

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.