[PATCH] net: enetc: Fix use after free issue in fsl_enetc.c

If ethernet connected to SFP, like this:
&enetc_port0 { phy-connection-type = "sgmii"; sfp = <&sfp0>; managed = "in-band-status"; status = "okay"; };
Then enetc_config_phy returns -ENODEV and the memory containing the mdio interface is freed. It's better to unregister and free mdio resources.
Signed-off-by: Siarhei Yasinski siarhei.yasinski@sintecs.eu
diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c index cd4c2c29a6..835e5bd8bd 100644 --- a/drivers/net/fsl_enetc.c +++ b/drivers/net/fsl_enetc.c @@ -22,6 +22,8 @@
#define ENETC_DRIVER_NAME "enetc_eth"
+static int enetc_remove(struct udevice *dev); + /* * sets the MAC address in IERB registers, this setting is persistent and * carried over to Linux. @@ -319,6 +321,7 @@ static int enetc_config_phy(struct udevice *dev) static int enetc_probe(struct udevice *dev) { struct enetc_priv *priv = dev_get_priv(dev); + int res;
if (ofnode_valid(dev_ofnode(dev)) && !ofnode_is_available(dev_ofnode(dev))) { enetc_dbg(dev, "interface disabled\n"); @@ -350,7 +353,10 @@ static int enetc_probe(struct udevice *dev)
enetc_start_pcs(dev);
- return enetc_config_phy(dev); + res = enetc_config_phy(dev); + if(res) + enetc_remove(dev); + return res; }
/*

On Wed, 31 Aug 2022 at 05:20, Siarhei Yasinski siarhei.yasinski@sintecs.eu wrote:
If ethernet connected to SFP, like this:
&enetc_port0 { phy-connection-type = "sgmii"; sfp = <&sfp0>; managed = "in-band-status"; status = "okay"; };
Then enetc_config_phy returns -ENODEV and the memory containing the mdio interface is freed. It's better to unregister and free mdio resources.
Signed-off-by: Siarhei Yasinski siarhei.yasinski@sintecs.eu
Reviewed-by: Simon Glass sjg@chromium.org
but note we normally use the var name 'ret' with driver model.
diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c index cd4c2c29a6..835e5bd8bd 100644 --- a/drivers/net/fsl_enetc.c +++ b/drivers/net/fsl_enetc.c @@ -22,6 +22,8 @@
#define ENETC_DRIVER_NAME "enetc_eth"
+static int enetc_remove(struct udevice *dev);
/*
- sets the MAC address in IERB registers, this setting is persistent and
- carried over to Linux.
@@ -319,6 +321,7 @@ static int enetc_config_phy(struct udevice *dev) static int enetc_probe(struct udevice *dev) { struct enetc_priv *priv = dev_get_priv(dev);
int res; if (ofnode_valid(dev_ofnode(dev)) && !ofnode_is_available(dev_ofnode(dev))) { enetc_dbg(dev, "interface disabled\n");
@@ -350,7 +353,10 @@ static int enetc_probe(struct udevice *dev)
enetc_start_pcs(dev);
return enetc_config_phy(dev);
res = enetc_config_phy(dev);
if(res)
enetc_remove(dev);
return res;
}
/*

On Wed, Aug 31, 2022 at 4:49 PM Simon Glass sjg@chromium.org wrote:
On Wed, 31 Aug 2022 at 05:20, Siarhei Yasinski siarhei.yasinski@sintecs.eu wrote:
If ethernet connected to SFP, like this:
&enetc_port0 { phy-connection-type = "sgmii"; sfp = <&sfp0>; managed = "in-band-status"; status = "okay"; };
Then enetc_config_phy returns -ENODEV and the memory containing the mdio interface is freed. It's better to unregister and free mdio resources.
Signed-off-by: Siarhei Yasinski siarhei.yasinski@sintecs.eu
Reviewed-by: Simon Glass sjg@chromium.org
but note we normally use the var name 'ret' with driver model.
diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c index cd4c2c29a6..835e5bd8bd 100644 --- a/drivers/net/fsl_enetc.c +++ b/drivers/net/fsl_enetc.c @@ -22,6 +22,8 @@
#define ENETC_DRIVER_NAME "enetc_eth"
+static int enetc_remove(struct udevice *dev);
/*
- sets the MAC address in IERB registers, this setting is persistent and
- carried over to Linux.
@@ -319,6 +321,7 @@ static int enetc_config_phy(struct udevice *dev) static int enetc_probe(struct udevice *dev) { struct enetc_priv *priv = dev_get_priv(dev);
int res; if (ofnode_valid(dev_ofnode(dev)) && !ofnode_is_available(dev_ofnode(dev))) { enetc_dbg(dev, "interface disabled\n");
@@ -350,7 +353,10 @@ static int enetc_probe(struct udevice *dev)
enetc_start_pcs(dev);
return enetc_config_phy(dev);
res = enetc_config_phy(dev);
if(res)
enetc_remove(dev);
return res;
}
/*
Reviewed-by: Ramon Fried rfried.dev@gmail.com
participants (3)
-
Ramon Fried
-
Siarhei Yasinski
-
Simon Glass