Re: net: fec: memory corruption caused by err_enet_mii_probe error path

quoted

err_enet_mii_probe:
fec_enet_free_buffers(ndev);
err_enet_alloc:
fec_enet_clk_enable(ndev, false);
clk_enable:
pm_runtime_mark_last_busy(&fep->pdev->dev);
pm_runtime_put_autosuspend(&fep->pdev->dev);
pinctrl_pm_select_sleep_state(&fep->pdev->dev);
return ret;

This error path frees the DMA buffers, BUT as far I could see it does not stop
the DMA engines.
=> open() fails => frees buffers => DMA still active => MAC receives network
packet => DMA starts => random memory corruption (use after
free) => random kernel panics

A question here, why receive path still active? MAC has not
connected to PHY when this failure happened, should not see network
activities.

Not every system has a PHY. There are plenty of boards with the FEC
directly connected to an Ethernet switch. So packets could be flowing.

	 Andrew