dpaa2_switch_probe() reuses i while probing ports, adding NAPI instances, registering netdevs, and unwinding failures. Consequently, the value reaching the port removal loop does not always represent the number of successfully probed ports. If IRQ setup fails, i is left equal to DPAA2_SWITCH_RX_NUM_FQS. A switch with one interface then causes the unwind path to access ports[1] out of bounds, while a switch with more than two interfaces leaks all ports after ports[1]. If register_netdev() fails, the unregister loop consumes i down to -1. The following port removal loop is therefore skipped, leaking every port netdev and its MAC endpoint reference. The NAPI instances attached to port 0 also remain linked while their enclosing ethsw is freed. The issue was discovered by a static analysis tool and confirmed by manually tracing the probe error paths. Track successfully probed and registered ports independently. On post-NAPI failures, unregister only successfully registered netdevs, delete the NAPI instances, and then remove every successfully probed port. Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface") Cc: stable@vger.kernel.org Signed-off-by: Jaeyeong Lee --- .../ethernet/freescale/dpaa2/dpaa2-switch.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c index fe8ac5e85259..0d80706ac41f 100644 --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c @@ -4086,6 +4086,8 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) { struct device *dev = &sw_dev->dev; struct ethsw_core *ethsw; + int registered_ports = 0; + int probed_ports = 0; int i, err; /* Allocate switch core*/ @@ -4148,7 +4150,8 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) for (i = 0; i < ethsw->sw_attr.num_ifs; i++) { err = dpaa2_switch_probe_port(ethsw, i); if (err) - goto err_free_netdev; + goto err_remove_ports; + probed_ports++; } /* Add a NAPI instance for each of the Rx queues. The first port's @@ -4178,19 +4181,22 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) dev_err(dev, "register_netdev error %d\n", err); goto err_unregister_ports; } + registered_ports++; } return 0; err_unregister_ports: - for (i--; i >= 0; i--) - unregister_netdev(ethsw->ports[i]->netdev); + while (registered_ports) + unregister_netdev(ethsw->ports[--registered_ports]->netdev); dpaa2_switch_teardown_irqs(sw_dev); err_stop: dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle); -err_free_netdev: - for (i--; i >= 0; i--) - dpaa2_switch_remove_port(ethsw, i); + for (i = 0; i < DPAA2_SWITCH_RX_NUM_FQS; i++) + netif_napi_del(ðsw->fq[i].napi); +err_remove_ports: + while (probed_ports) + dpaa2_switch_remove_port(ethsw, --probed_ports); for (i = 0; i < ethsw->sw_attr.num_ifs; i++) mutex_destroy(ðsw->lags[i].fdb_lock); kfree(ethsw->lags); -- 2.43.0