diff mbox series

[3/5] net: renesas: rswitch: avoid use-after-put for a device tree node

Message ID 20241202134904.3882317-4-nikita.yoush@cogentembedded.com (mailing list archive)
State Superseded
Delegated to: Geert Uytterhoeven
Headers show
Series net: renesas: rswitch: several fixes | expand

Commit Message

Nikita Yushchenko Dec. 2, 2024, 1:49 p.m. UTC
The device tree node saved in the rswitch_device structure is used at
several driver locations. So passing this node to of_node_put() after
the first use is wrong.

Move of_node_put() for this node to exit paths.

Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling")
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
---
 drivers/net/ethernet/renesas/rswitch.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

Jacob Keller Dec. 4, 2024, 12:24 a.m. UTC | #1
On 12/2/2024 5:49 AM, Nikita Yushchenko wrote:
> The device tree node saved in the rswitch_device structure is used at
> several driver locations. So passing this node to of_node_put() after
> the first use is wrong.
> 
> Move of_node_put() for this node to exit paths.
> 
> Fixes: b46f1e579329 ("net: renesas: rswitch: Simplify struct phy * handling")
> Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
> ---

Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>

>  drivers/net/ethernet/renesas/rswitch.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
> index 3ad5858d3cdd..779c05b8e05f 100644
> --- a/drivers/net/ethernet/renesas/rswitch.c
> +++ b/drivers/net/ethernet/renesas/rswitch.c
> @@ -1891,7 +1891,6 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index
>  	rdev->np_port = rswitch_get_port_node(rdev);
>  	rdev->disabled = !rdev->np_port;
>  	err = of_get_ethdev_address(rdev->np_port, ndev);
> -	of_node_put(rdev->np_port);
>  	if (err) {
>  		if (is_valid_ether_addr(rdev->etha->mac_addr))
>  			eth_hw_addr_set(ndev, rdev->etha->mac_addr);
> @@ -1921,6 +1920,7 @@ static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index
>  
>  out_rxdmac:
>  out_get_params:
> +	of_node_put(rdev->np_port);
>  	netif_napi_del(&rdev->napi);
>  	free_netdev(ndev);
>  
> @@ -1934,6 +1934,7 @@ static void rswitch_device_free(struct rswitch_private *priv, unsigned int index
>  
>  	rswitch_txdmac_free(ndev);
>  	rswitch_rxdmac_free(ndev);
> +	of_node_put(rdev->np_port);
>  	netif_napi_del(&rdev->napi);
>  	free_netdev(ndev);
>  }
diff mbox series

Patch

diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index 3ad5858d3cdd..779c05b8e05f 100644
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -1891,7 +1891,6 @@  static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index
 	rdev->np_port = rswitch_get_port_node(rdev);
 	rdev->disabled = !rdev->np_port;
 	err = of_get_ethdev_address(rdev->np_port, ndev);
-	of_node_put(rdev->np_port);
 	if (err) {
 		if (is_valid_ether_addr(rdev->etha->mac_addr))
 			eth_hw_addr_set(ndev, rdev->etha->mac_addr);
@@ -1921,6 +1920,7 @@  static int rswitch_device_alloc(struct rswitch_private *priv, unsigned int index
 
 out_rxdmac:
 out_get_params:
+	of_node_put(rdev->np_port);
 	netif_napi_del(&rdev->napi);
 	free_netdev(ndev);
 
@@ -1934,6 +1934,7 @@  static void rswitch_device_free(struct rswitch_private *priv, unsigned int index
 
 	rswitch_txdmac_free(ndev);
 	rswitch_rxdmac_free(ndev);
+	of_node_put(rdev->np_port);
 	netif_napi_del(&rdev->napi);
 	free_netdev(ndev);
 }