dpaa2_eth_remove() and the probe error path call fsl_mc_free_irqs(),
which returns MC interrupt resources without removing the devm-managed
handler. Until devres runs, a link or endpoint change can race with MAC
disconnection or access the freed MC portal and net device.
Add dpaa2_eth_free_irqs() to release and synchronize the handler before
returning its MC resource. Use it before disconnecting the MAC and freeing
the portal and net device in both paths.
Found by a static analysis tool under development.
Not tested on hardware.
Fixes: 6e2387e8f19e ("staging: fsl-dpaa2/eth: Add Freescale DPAA2 Ethernet driver")
Cc: <redacted>
Co-developed-by: Ijae Kim <redacted>
Signed-off-by: Ijae Kim <redacted>
Signed-off-by: Myeonghun Pak <redacted>
---
drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
index 7227a35dfaf2..91462b88b34a 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
@@ -4824,6 +4824,14 @@ static int dpaa2_eth_setup_irqs(struct fsl_mc_device *ls_dev)
return err;
}
+static void dpaa2_eth_free_irqs(struct fsl_mc_device *ls_dev)
+{
+ struct fsl_mc_device_irq *irq = ls_dev->irqs[0];
+
+ devm_free_irq(&ls_dev->dev, irq->virq, &ls_dev->dev);
+ fsl_mc_free_irqs(ls_dev);
+}
+
static void dpaa2_eth_add_ch_napi(struct dpaa2_eth_priv *priv)
{
int i;@@ -5044,7 +5052,7 @@ static int dpaa2_eth_probe(struct fsl_mc_device *dpni_dev)
if (priv->do_link_poll)
kthread_stop(priv->poll_thread);
else
- fsl_mc_free_irqs(dpni_dev);
+ dpaa2_eth_free_irqs(dpni_dev);
err_poll_thread:
dpaa2_eth_disconnect_mac(priv);
err_connect_mac:
@@ -5104,7 +5112,7 @@ static void dpaa2_eth_remove(struct fsl_mc_device *ls_dev)
if (priv->do_link_poll)
kthread_stop(priv->poll_thread);
else
- fsl_mc_free_irqs(ls_dev);
+ dpaa2_eth_free_irqs(ls_dev);
dpaa2_eth_disconnect_mac(priv);
dpaa2_eth_free_rings(priv);
base-commit: 0edbc945eb9edd0086f25b151a79cfe4adc0dfa8
--
2.43.0