If an error occurs during mv88e6xxx_setup() and the PTP clock has been registered, the clock will not be unregistered as mv88e6xxx_ptp_free() will not be called. mv88e6xxx_hwtstamp_free() also is not called. As mv88e6xxx_ptp_free() can cope with being called without a successful call to mv88e6xxx_ptp_setup(), and mv88e6xxx_hwtstamp_free() is empty, add both these *_free() calls to the error cleanup paths in mv88e6xxx_setup(). Moreover, mv88e6xxx_teardown() should teardown setup done in mv88e6xxx_setup() - see dsa_switch_setup(). However, instead *_free() are called from mv88e6xxx_remove() function that is only called when a device is unbound, which omits cleanup should a failure occur later in dsa_switch_setup(). Move the *_free() calls from mv88e6xxx_remove() to mv88e6xxx_teardown(). Note that mv88e6xxx_ptp_setup() must be called holding the reg_lock, but mv88e6xxx_ptp_free() must never be. This is especially true after commit "ptp: rework ptp_clock_unregister() to disable events". This patch does not change this, but adds a comment to that effect. Signed-off-by: Russell King (Oracle) --- This is a long-standing bug, and I don't think it makes sense to rush it in via the net tree as a failure to trigger it is very unlikely to happen. drivers/net/dsa/mv88e6xxx/chip.c | 15 +++++++-------- drivers/net/dsa/mv88e6xxx/ptp.c | 1 + 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 25d4c89d36b8..b4d48997bf46 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -3965,6 +3965,8 @@ static void mv88e6xxx_teardown(struct dsa_switch *ds) mv88e6xxx_teardown_devlink_params(ds); dsa_devlink_resources_unregister(ds); mv88e6xxx_teardown_devlink_regions_global(ds); + mv88e6xxx_hwtstamp_free(chip); + mv88e6xxx_ptp_free(chip); mv88e6xxx_mdios_unregister(chip); } @@ -4105,7 +4107,7 @@ static int mv88e6xxx_setup(struct dsa_switch *ds) mv88e6xxx_reg_unlock(chip); if (err) - goto out_mdios; + goto out_hwtstamp; /* Have to be called without holding the register lock, since * they take the devlink lock, and we later take the locks in @@ -4114,7 +4116,7 @@ static int mv88e6xxx_setup(struct dsa_switch *ds) */ err = mv88e6xxx_setup_devlink_resources(ds); if (err) - goto out_mdios; + goto out_hwtstamp; err = mv88e6xxx_setup_devlink_params(ds); if (err) @@ -4130,7 +4132,9 @@ static int mv88e6xxx_setup(struct dsa_switch *ds) mv88e6xxx_teardown_devlink_params(ds); out_resources: dsa_devlink_resources_unregister(ds); -out_mdios: +out_hwtstamp: + mv88e6xxx_hwtstamp_free(chip); + mv88e6xxx_ptp_free(chip); mv88e6xxx_mdios_unregister(chip); return err; @@ -7439,11 +7443,6 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev) chip = ds->priv; - if (chip->info->ptp_support) { - mv88e6xxx_hwtstamp_free(chip); - mv88e6xxx_ptp_free(chip); - } - mv88e6xxx_unregister_switch(chip); mv88e6xxx_g1_vtu_prob_irq_free(chip); diff --git a/drivers/net/dsa/mv88e6xxx/ptp.c b/drivers/net/dsa/mv88e6xxx/ptp.c index 89fb61ea891d..fa17ad6e378f 100644 --- a/drivers/net/dsa/mv88e6xxx/ptp.c +++ b/drivers/net/dsa/mv88e6xxx/ptp.c @@ -551,6 +551,7 @@ int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip) return 0; } +/* This must never be called holding the register lock */ void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip) { if (chip->ptp_clock) { -- 2.47.3