[PATCH net] net: sparx5: skip ptp deinit if init was skipped

[PATCH net] net: sparx5: skip ptp deinit if init was skipped

[Quentin Freimanis]

sparx5_ptp_init() returns early on the base lan969x variants
because they do not have the SPX5_FEATURE_PTP flag. It also returns early
when no "ptp" interrupt is described. Unbinding the driver then causes a
NULL pointer dereference when cleaning up uninitialized tx_skbs queues:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000008
    Call trace:
    skb_queue_purge_reason+0x68/0x120 (P)
    sparx5_ptp_deinit+0x64/0xc0
    mchp_sparx5_remove+0x38/0x70
    platform_remove+0x20/0x30
    device_remove+0x4c/0x80

Before per-port tx_skbs were added, a NULL dereference would have happened
when calling ptp_clock_unregister() on the never-registered PTP clocks.

Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

Fixes: 0933bd04047c ("net: sparx5: Add support for ptp clocks")
Signed-off-by: Quentin Freimanis <quentin@q-lab.dev>
---
 drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c b/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
index a16ec8136d6d..5953e04ef14e 100644
--- a/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
+++ b/drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c
@@ -673,6 +673,9 @@ void sparx5_ptp_deinit(struct sparx5 *sparx5)
 	struct sparx5_port *port;
 	int i;
 
+	if (!sparx5->ptp)
+		return;
+
 	if (sparx5->ptp_irq >= 0) {
 		disable_irq(sparx5->ptp_irq);
 		sparx5->ptp_irq = -ENXIO;
-- 
2.55.0

Re: [PATCH net] net: sparx5: skip ptp deinit if init was skipped

[Daniel Machon]

Hi Quentin,

> sparx5_ptp_init() returns early on the base lan969x variants
> because they do not have the SPX5_FEATURE_PTP flag. It also returns early
> when no "ptp" interrupt is described. Unbinding the driver then causes a
> NULL pointer dereference when cleaning up uninitialized tx_skbs queues:
> 
>     Unable to handle kernel NULL pointer dereference at virtual address
>     0000000000000008
>     Call trace:
>     skb_queue_purge_reason+0x68/0x120 (P)
>     sparx5_ptp_deinit+0x64/0xc0
>     mchp_sparx5_remove+0x38/0x70
>     platform_remove+0x20/0x30
>     device_remove+0x4c/0x80
> 
> Before per-port tx_skbs were added, a NULL dereference would have happened
> when calling ptp_clock_unregister() on the never-registered PTP clocks.
> 
> Fix by returning early in sparx5_ptp_deinit() if PTP is not used.
> 
> Fixes: 0933bd04047c ("net: sparx5: Add support for ptp clocks")
> Signed-off-by: Quentin Freimanis <quentin@q-lab.dev>

Reviewed-by: Daniel Machon <daniel.machon@microchip.com>
Tested-by: Daniel Machon <daniel.machon@microchip.com>

Thanks!

/Daniel