[PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[Wentao Liang]

mlxsw_sp1_ptp_mtpppc_update() increases the global parsing depth
reference count before writing the MTPPPC register when timestamping
is enabled for the first time. If the register write fails, the
reference count remains elevated even though no timestamping
configuration was installed, and nothing will ever release it.

Drop the reference count again when the write fails. Also only drop it
when disabling timestamping after the write succeeded, so that the
reference count always matches the programmed state.

Fixes: c6b36bdd04b5 ("mlxsw: spectrum_ptp: Increase parsing depth when PTP is enabled")
Cc: stable@vger.kernel.org
Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
index 9c5862f4e16a..0db77af4828f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
@@ -1190,6 +1190,7 @@ static int mlxsw_sp1_ptp_mtpppc_update(struct mlxsw_sp_port *mlxsw_sp_port,
 	struct mlxsw_sp_port *tmp;
 	u16 orig_ing_types = 0;
 	u16 orig_egr_types = 0;
+	bool depth_inc = false;
 	int err;
 	int i;
 
@@ -1214,12 +1215,21 @@ static int mlxsw_sp1_ptp_mtpppc_update(struct mlxsw_sp_port *mlxsw_sp_port,
 			netdev_err(mlxsw_sp_port->dev, "Failed to increase parsing depth");
 			return err;
 		}
+		depth_inc = true;
 	}
+
+	err = mlxsw_sp1_ptp_mtpppc_set(mlxsw_sp_port->mlxsw_sp,
+				       ing_types, egr_types);
+	if (err) {
+		if (depth_inc)
+			mlxsw_sp_parsing_depth_dec(mlxsw_sp);
+		return err;
+	}
+
 	if (!(ing_types || egr_types) && (orig_ing_types || orig_egr_types))
 		mlxsw_sp_parsing_depth_dec(mlxsw_sp);
 
-	return mlxsw_sp1_ptp_mtpppc_set(mlxsw_sp_port->mlxsw_sp,
-				       ing_types, egr_types);
+	return 0;
 }
 
 static bool mlxsw_sp1_ptp_hwtstamp_enabled(struct mlxsw_sp_port *mlxsw_sp_port)
-- 
2.34.1

Re: [PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:28:51 +0000, Wentao Liang wrote:
> mlxsw_sp1_ptp_mtpppc_update() increases the global parsing depth
> reference count before writing the MTPPPC register when timestamping
> is enabled for the first time. If the register write fails, the
> reference count remains elevated even though no timestamping
> configuration was installed, and nothing will ever release it.
> 
> Drop the reference count again when the write fails. Also only drop it
> when disabling timestamping after the write succeeded, so that the
> reference count always matches the programmed state.
> 
> Fixes: c6b36bdd04b5 ("mlxsw: spectrum_ptp: Increase parsing depth when PTP is enabled")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 



Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[Krzysztof Kozlowski]

On Tue, 03 Nov 2026 10:28:51 +0000, Wentao Liang wrote:
> mlxsw_sp1_ptp_mtpppc_update() increases the global parsing depth
> reference count before writing the MTPPPC register when timestamping
> is enabled for the first time. If the register write fails, the
> reference count remains elevated even though no timestamping
> configuration was installed, and nothing will ever release it.
> 
> Drop the reference count again when the write fails. Also only drop it
> when disabling timestamping after the write succeeded, so that the
> reference count always matches the programmed state.
> 
> Fixes: c6b36bdd04b5 ("mlxsw: spectrum_ptp: Increase parsing depth when PTP is enabled")
> Cc: stable@vger.kernel.org
> Assisted-by: DeepSeek-V4.1-Flash and OpenAI Codex
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 

Multiple things here:
1. Your team ignored completely previous feedback. Multiple times.

2. You use multiple identities with this email address, thus I doubt that we
   speak with an actual person.

3. Your bot does not even bother running checkpatch, right?

4. Nothing of this was reproduced nor tested.

5. Finally, the same feedback:
You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem (so a patchset grouping multiple patches with a short cover
letter), how to document the issue discovery method and what was
or was not tested.

Best regards,
Krzysztof

Re: [PATCH] mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

[netdev-bot+sashiko]

Thank you for your contribution! Sashiko AI review found 1 potential
issue(s) to consider.

Critical: 0 · High: 1 (1) · Medium: 0 · Low: 0 (1)

If you believe none of the issues are legitimate, please reply to each
issue of Medium severity or higher and explain why the AI is wrong.
If any of them are legitimate and you plan to respin, please let patchwork
know by including "pw-bot: cr" as a separate line at the end of your reply
(one such reply per series is enough).

- [High] The patch fixes the enable-path leak but adds the same leak on
  the port-removal path.

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but
  mlxsw_sp1_ptp_mtpppc_update() has no serialization between its two…
- [Low] The new rollback in mlxsw_sp1_ptp_mtpppc_update()
  (spectrum_ptp.c:1223-1226) calls mlxsw_sp_parsing_depth_dec().

--

mlxsw: spectrum_ptp: release parsing depth on MTPPPC write failure

This patch reorders mlxsw_sp1_ptp_mtpppc_update() so the MTPPPC register is
written before the parsing depth reference is adjusted. If the write fails,
the reference taken on the first enable is released. On the disable
transition, the reference is now dropped only after the write succeeds.

> diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
> index 9c5862f4e16a3..0db77af4828f1 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ptp.c

[ ... ]

> @@ -1214,12 +1215,21 @@ static int mlxsw_sp1_ptp_mtpppc_update(struct mlxsw_sp_port *mlxsw_sp_port,
>  			netdev_err(mlxsw_sp_port->dev, "Failed to increase parsing depth");
>  			return err;
>  		}
> +		depth_inc = true;
>  	}
> +
> +	err = mlxsw_sp1_ptp_mtpppc_set(mlxsw_sp_port->mlxsw_sp,
> +				       ing_types, egr_types);
> +	if (err) {
> +		if (depth_inc)
> +			mlxsw_sp_parsing_depth_dec(mlxsw_sp);

[Severity: Low]
This is a pre-existing issue, but mlxsw_sp_parsing_depth_dec() ignores the
result of the MPRS write and sets the cached depth anyway:

drivers/net/ethernet/mellanox/mlxsw/spectrum.c:mlxsw_sp_parsing_depth_dec() {
    ...
	mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(mprs), mprs_pl);
	mlxsw_sp->parsing.parsing_depth = MLXSW_SP_DEFAULT_PARSING_DEPTH;
    ...
}

Suppose the MPRS write also fails on this new rollback path. Would the ASIC
then stay at the increased parsing depth while software records the default
depth with no references held?

The existing VXLAN and IPIP callers have the same behaviour. The next MPRS
write would bring hardware and software back in line.

> +		return err;
> +	}
> +
>  	if (!(ing_types || egr_types) && (orig_ing_types || orig_egr_types))
>  		mlxsw_sp_parsing_depth_dec(mlxsw_sp);

[Severity: High]
Can this leak the parsing depth reference when a port is removed?

mlxsw_sp_port_remove() calls mlxsw_sp_port_ptp_clear(), and that helper
ignores the return value of hwtstamp_set():

drivers/net/ethernet/mellanox/mlxsw/spectrum.c:mlxsw_sp_port_ptp_clear() {
	struct kernel_hwtstamp_config config = {};

	mlxsw_sp_port->mlxsw_sp->ptp_ops->hwtstamp_set(mlxsw_sp_port, &config,
						       NULL);
}

Take the case where the removed port is the last one with timestamping
enabled and the MTPPPC write fails during this clear. This can happen on
devlink reload, port split/unsplit, line card removal or driver unbind.

mlxsw_sp1_ptp_mtpppc_update() now returns before the disable-path
mlxsw_sp_parsing_depth_dec(). mlxsw_sp1_ptp_hwtstamp_set() then returns
before it clears ptp.ing_types and ptp.egr_types.

mlxsw_sp_port_remove() carries on regardless:

	mlxsw_sp_port_ptp_clear(mlxsw_sp_port);
	mlxsw_sp_port_vlan_classification_set(mlxsw_sp_port, true, true);
	mlxsw_sp->ports[local_port] = NULL;
	...
	free_netdev(mlxsw_sp_port->dev);

After the port leaves mlxsw_sp->ports[], no later orig_ing_types or
orig_egr_types scan can see it, so nothing ever drops that reference.

The next first enable on another port sees orig == 0 and takes the
reference again, so the count goes to 2. Disabling that port only brings it
back to 1, and MPRS stays at the increased depth even though MTPPPC has
been written to 0.

mlxsw_sp1_ptp_fini() then writes MTPPPC to 0 without releasing anything,
and mlxsw_sp_parsing_fini() would hit:

	WARN_ON_ONCE(refcount_read(&mlxsw_sp->parsing.parsing_depth_ref));

The old code dropped the reference before the write. That is the behaviour
this caller depends on, since it throws away the port's software state
whatever the result.

The commit message says:

    so that the reference count always matches the programmed state.

Would the removal path need a forced release, for example in
mlxsw_sp_port_ptp_clear(), for this to hold?

>  
> -	return mlxsw_sp1_ptp_mtpppc_set(mlxsw_sp_port->mlxsw_sp,
> -				       ing_types, egr_types);
> +	return 0;
>  }

[Severity: High]
This is a pre-existing issue, but is mlxsw_sp1_ptp_mtpppc_update()
serialized against port removal at all?

The ndo_hwtstamp_set path runs under RTNL only: dev_ioctl() takes
rtnl_net_lock() for SIOCSHWTSTAMP. mlxsw_sp_port_remove() calls
mlxsw_sp_port_ptp_clear() after unregister_netdev() has already released
RTNL, so that path holds only the devlink instance lock.

The function reads every port's types with no common lock held:

	for (i = 1; i < mlxsw_core_max_ports(mlxsw_sp->core); i++) {
		tmp = mlxsw_sp->ports[i];
		if (tmp) {
			orig_ing_types |= tmp->ptp.ing_types;
	...

It then decides whether to inc or dec and writes the global MTPPPC
register. The per-port types are published only afterwards, in
mlxsw_sp1_ptp_hwtstamp_set(). parsing.lock is taken only inside the inc/dec
helpers, so it does not cover the check-then-act sequence.

Start with port A as the only timestamping port (ref = 1):

CPU0 (removing port A)              CPU1 (enabling port B)
mtpppc_update()
  orig != 0, new == 0
                                    mtpppc_update()
                                      sees A's types, skips inc
                                      MTPPPC = A|B
  MTPPPC = 0
  parsing_depth_dec() -> ref = 0

Port B now believes timestamping is enabled, but MTPPPC is 0 and the parsing
depth is back at the default. When B is disabled later it decrements again.
That either underflows the refcount or drops a reference held by VXLAN or
IPIP.

There is also a lifetime problem. CPU1 loads tmp = mlxsw_sp->ports[i] and
then dereferences tmp->ptp.*. In the meantime CPU0 can set
mlxsw_sp->ports[local_port] = NULL and call free_netdev(). The port is
netdev_priv(), so can this read freed memory?

Under this concurrency, the "always matches the programmed state" claim in
the commit message doesn't seem to hold either.

-- 
Sashiko AI review · https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20261103102851.1340480-1-vulab%40iscas.ac.cn