From: Xuanqiang Luo phy_probe() uses one cleanup path for failures at every initialization stage. This runs cleanup for resources that have not been initialized. Split the cleanup by initialization stage so each failure path unwinds only the resources that may have been initialized. Signed-off-by: Xuanqiang Luo --- drivers/net/phy/phy_device.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 0615228459ef4..c9976ffa7128c 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3681,7 +3681,7 @@ static int phy_probe(struct device *dev) if (phydev->drv->probe) { err = phydev->drv->probe(phydev); if (err) - goto out; + goto out_reset; } phy_disable_interrupts(phydev); @@ -3702,7 +3702,7 @@ static int phy_probe(struct device *dev) err = genphy_read_abilities(phydev); if (err) - goto out; + goto out_reset; if (!linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, phydev->supported)) @@ -3719,7 +3719,7 @@ static int phy_probe(struct device *dev) err = phy_setup_ports(phydev); if (err) - goto out; + goto out_ports; phy_advertise_supported(phydev); @@ -3728,7 +3728,7 @@ static int phy_probe(struct device *dev) */ err = genphy_c45_read_eee_adv(phydev, phydev->advertising_eee); if (err) - goto out; + goto out_ports; /* Get the EEE modes we want to prohibit. */ of_set_phy_eee_broken(phydev); @@ -3781,20 +3781,22 @@ static int phy_probe(struct device *dev) if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev)) { err = of_phy_leds(phydev); if (err) - goto out; + goto out_led_triggers; } return 0; -out: +out_led_triggers: + if (!phydev->is_on_sfp_module) + phy_led_triggers_unregister(phydev); + +out_ports: sfp_bus_del_upstream(phydev->sfp_bus); phydev->sfp_bus = NULL; phy_cleanup_ports(phydev); - if (!phydev->is_on_sfp_module) - phy_led_triggers_unregister(phydev); - +out_reset: /* Re-assert the reset signal on error */ phy_device_reset(phydev, 1); -- 2.43.0 From: Xuanqiang Luo Commit 4497f5028675 ("net: phy: Clean the phy_ports after unregistering the downstream SFP bus") established that an SFP upstream must be unregistered before its phy_ports are destroyed because SFP callbacks may access these ports. phy_setup_ports() does not follow this order when a later port setup step fails after phy_sfp_probe() succeeds. It destroys the SFP phy_port and leaves phy_probe() to unregister the upstream later, creating a race between port destruction and SFP upstream callbacks. The error unwind is also split across three functions. If phy_setup_sfp_port() fails, phy_sfp_probe() leaves the upstream registered and relies on phy_probe() to remove it after phy_setup_ports() returns. Make each layer unwind the resources it successfully set up. Unregister only the upstream in phy_sfp_probe() when SFP port setup fails, since the failed port has already been destroyed. Add phy_sfp_release() for a successful SFP probe, and make phy_setup_ports() use it before cleaning up the remaining ports. Once phy_setup_ports() has rolled back all port setup, make phy_probe() skip this cleanup. Fixes: 589e934d2735 ("net: phy: Introduce PHY ports representation") Signed-off-by: Xuanqiang Luo --- drivers/net/phy/phy_device.c | 49 ++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 11 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c9976ffa7128c..9c7ed9c61e6d5 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1723,12 +1723,41 @@ static int phy_sfp_probe(struct phy_device *phydev) phydev->sfp_bus = NULL; } - if (!ret && phydev->sfp_bus) + if (!ret && phydev->sfp_bus) { ret = phy_setup_sfp_port(phydev); + if (ret) { + sfp_bus_del_upstream(phydev->sfp_bus); + phydev->sfp_bus = NULL; + } + } return ret; } +/** + * phy_sfp_release - release resources set up by phy_sfp_probe() + * @phydev: the PHY device + * + * Release the SFP resources set up by a successful phy_sfp_probe(). Unregister + * the upstream before destroying its phy_port, so SFP upstream callbacks cannot + * race with port destruction. + */ +static void phy_sfp_release(struct phy_device *phydev) +{ + struct phy_port *port, *tmp; + + sfp_bus_del_upstream(phydev->sfp_bus); + phydev->sfp_bus = NULL; + + list_for_each_entry_safe(port, tmp, &phydev->ports, head) { + if (!port->is_sfp) + continue; + + phy_del_port(phydev, port); + phy_port_destroy(port); + } +} + static bool phy_drv_supports_irq(const struct phy_driver *phydrv) { return phydrv->config_intr && phydrv->handle_interrupt; @@ -3522,13 +3551,13 @@ static int phy_setup_ports(struct phy_device *phydev) if (!phydev->is_genphy_driven) { ret = phy_sfp_probe(phydev); if (ret) - goto out; + goto err_ports; } if (phydev->n_ports < phydev->max_n_ports) { ret = phy_default_setup_single_port(phydev); if (ret) - goto out; + goto err_sfp; } linkmode_zero(ports_supported); @@ -3555,7 +3584,9 @@ static int phy_setup_ports(struct phy_device *phydev) return 0; -out: +err_sfp: + phy_sfp_release(phydev); +err_ports: phy_cleanup_ports(phydev); return ret; } @@ -3719,7 +3750,7 @@ static int phy_probe(struct device *dev) err = phy_setup_ports(phydev); if (err) - goto out_ports; + goto out_reset; phy_advertise_supported(phydev); @@ -3791,9 +3822,7 @@ static int phy_probe(struct device *dev) phy_led_triggers_unregister(phydev); out_ports: - sfp_bus_del_upstream(phydev->sfp_bus); - phydev->sfp_bus = NULL; - + phy_sfp_release(phydev); phy_cleanup_ports(phydev); out_reset: @@ -3817,9 +3846,7 @@ static int phy_remove(struct device *dev) phydev->state = PHY_DOWN; - sfp_bus_del_upstream(phydev->sfp_bus); - phydev->sfp_bus = NULL; - + phy_sfp_release(phydev); phy_cleanup_ports(phydev); if (phydev->drv && phydev->drv->remove) -- 2.43.0 From: Xuanqiang Luo phy_probe() sets phydev->drv before calling the PHY driver probe callback, but does not clear it if probing later fails. It also sets PHY_READY before of_phy_leds(), leaving the state ready if LED setup fails. Clear phydev->drv on every error path and restore PHY_DOWN after LED setup failure. Fixes: 00db8189d984 ("This patch adds a PHY Abstraction Layer to the Linux Kernel, enabling ethernet drivers to remain as ignorant as is reasonable of the connected PHY's design and operation details.") Signed-off-by: Xuanqiang Luo --- drivers/net/phy/phy_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 9c7ed9c61e6d5..c9e75bd3b81a2 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3821,6 +3821,8 @@ static int phy_probe(struct device *dev) if (!phydev->is_on_sfp_module) phy_led_triggers_unregister(phydev); + phydev->state = PHY_DOWN; + out_ports: phy_sfp_release(phydev); phy_cleanup_ports(phydev); @@ -3828,6 +3830,7 @@ static int phy_probe(struct device *dev) out_reset: /* Re-assert the reset signal on error */ phy_device_reset(phydev, 1); + phydev->drv = NULL; return err; } -- 2.43.0 From: Xuanqiang Luo phy_probe() may fail while querying features or completing other core initialization after the PHY driver probe callback has succeeded. The driver core does not run the remove path after a probe error, so resources that the PHY driver releases in its remove callback are leaked. Call the PHY driver remove callback on these failures. Fixes: efbdfdc29bdd ("net: phy: Add support for asking the PHY its abilities") Signed-off-by: Xuanqiang Luo --- drivers/net/phy/phy_device.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index c9e75bd3b81a2..e429e6d702933 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3733,7 +3733,7 @@ static int phy_probe(struct device *dev) err = genphy_read_abilities(phydev); if (err) - goto out_reset; + goto out_remove; if (!linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, phydev->supported)) @@ -3750,7 +3750,7 @@ static int phy_probe(struct device *dev) err = phy_setup_ports(phydev); if (err) - goto out_reset; + goto out_remove; phy_advertise_supported(phydev); @@ -3827,6 +3827,10 @@ static int phy_probe(struct device *dev) phy_sfp_release(phydev); phy_cleanup_ports(phydev); +out_remove: + if (phydev->drv->remove) + phydev->drv->remove(phydev); + out_reset: /* Re-assert the reset signal on error */ phy_device_reset(phydev, 1); -- 2.43.0 From: Xuanqiang Luo phy_default_setup_single_port() ignores errors from phy_add_port() and always reports success. If a PHY driver attach_mdi_port() callback fails, the phy_port is leaked and PHY probing continues without the expected default port. Destroy the port and return the error. Fixes: 589e934d2735 ("net: phy: Introduce PHY ports representation") Signed-off-by: Xuanqiang Luo --- drivers/net/phy/phy_device.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index e429e6d702933..b0060b4147348 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3458,6 +3458,7 @@ static int phy_default_setup_single_port(struct phy_device *phydev) { struct phy_port *port = phy_port_alloc(); unsigned long mode; + int ret; if (!port) return -ENOMEM; @@ -3484,9 +3485,11 @@ static int phy_default_setup_single_port(struct phy_device *phydev) port->pairs = max_t(int, port->pairs, ethtool_linkmode_n_pairs(mode)); - phy_add_port(phydev, port); + ret = phy_add_port(phydev, port); + if (ret) + phy_port_destroy(port); - return 0; + return ret; } static int of_phy_ports(struct phy_device *phydev) -- 2.43.0