Commit 8640f8dc authored by Russell King's avatar Russell King Committed by David S. Miller
Browse files

net: dsa: fix phylink_start()/phylink_stop() calls 



Place phylink_start()/phylink_stop() inside dsa_port_enable() and
dsa_port_disable(), which ensures that we call phylink_stop() before
tearing down phylink - which is a documented requirement.  Failure
to do so can cause use-after-free bugs.

Fixes: 0e279218 ("net: dsa: Use PHYLINK for the CPU/DSA ports")
Signed-off-by: default avatarRussell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: default avatarAndrew Lunn <andrew@lunn.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f650bcd4

net/dsa/dsa_priv.h

+2 −0
Original line number Original line Diff line number Diff line
@@ -117,7 +117,9 @@ static inline struct net_device *dsa_master_find_slave(struct net_device *dev, 
/* port.c */

/* port.c */

int dsa_port_set_state(struct dsa_port *dp, u8 state,

int dsa_port_set_state(struct dsa_port *dp, u8 state,

		       struct switchdev_trans *trans);

		       struct switchdev_trans *trans);

int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy);

int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy);

int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy);

void dsa_port_disable_rt(struct dsa_port *dp);

void dsa_port_disable(struct dsa_port *dp);

void dsa_port_disable(struct dsa_port *dp);

int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br);

int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br);

void dsa_port_bridge_leave(struct dsa_port *dp, struct net_device *br);

void dsa_port_bridge_leave(struct dsa_port *dp, struct net_device *br);

net/dsa/port.c

+26 −6
Original line number Original line Diff line number Diff line
@@ -63,7 +63,7 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state) 
		pr_err("DSA: failed to set STP state %u (%d)\n", state, err);

		pr_err("DSA: failed to set STP state %u (%d)\n", state, err);

}

}





int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)

int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy)

{

{

	struct dsa_switch *ds = dp->ds;

	struct dsa_switch *ds = dp->ds;

	int port = dp->index;

	int port = dp->index;
@@ -78,14 +78,31 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy) 
	if (!dp->bridge_dev)

	if (!dp->bridge_dev)

		dsa_port_set_state_now(dp, BR_STATE_FORWARDING);

		dsa_port_set_state_now(dp, BR_STATE_FORWARDING);





	if (dp->pl)

		phylink_start(dp->pl);



	return 0;

	return 0;

}

}





void dsa_port_disable(struct dsa_port *dp)

int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)

{

	int err;



	rtnl_lock();

	err = dsa_port_enable_rt(dp, phy);

	rtnl_unlock();



	return err;

}



void dsa_port_disable_rt(struct dsa_port *dp)

{

{

	struct dsa_switch *ds = dp->ds;

	struct dsa_switch *ds = dp->ds;

	int port = dp->index;

	int port = dp->index;





	if (dp->pl)

		phylink_stop(dp->pl);



	if (!dp->bridge_dev)

	if (!dp->bridge_dev)

		dsa_port_set_state_now(dp, BR_STATE_DISABLED);

		dsa_port_set_state_now(dp, BR_STATE_DISABLED);
@@ -93,6 +110,13 @@ void dsa_port_disable(struct dsa_port *dp) 
		ds->ops->port_disable(ds, port);

		ds->ops->port_disable(ds, port);

}

}





void dsa_port_disable(struct dsa_port *dp)

{

	rtnl_lock();

	dsa_port_disable_rt(dp);

	rtnl_unlock();

}



int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br)

int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br)

{

{

	struct dsa_notifier_bridge_info info = {

	struct dsa_notifier_bridge_info info = {
@@ -614,10 +638,6 @@ static int dsa_port_phylink_register(struct dsa_port *dp) 
		goto err_phy_connect;

		goto err_phy_connect;

	}

	}





	rtnl_lock();

	phylink_start(dp->pl);

	rtnl_unlock();



	return 0;

	return 0;





err_phy_connect:

err_phy_connect:

net/dsa/slave.c

+2 −6
Original line number Original line Diff line number Diff line
@@ -88,12 +88,10 @@ static int dsa_slave_open(struct net_device *dev) 
			goto clear_allmulti;

			goto clear_allmulti;

	}

	}





	err = dsa_port_enable(dp, dev->phydev);

	err = dsa_port_enable_rt(dp, dev->phydev);

	if (err)

	if (err)

		goto clear_promisc;

		goto clear_promisc;





	phylink_start(dp->pl);



	return 0;

	return 0;





clear_promisc:

clear_promisc:
@@ -114,9 +112,7 @@ static int dsa_slave_close(struct net_device *dev) 
	struct net_device *master = dsa_slave_to_master(dev);

	struct net_device *master = dsa_slave_to_master(dev);

	struct dsa_port *dp = dsa_slave_to_port(dev);

	struct dsa_port *dp = dsa_slave_to_port(dev);





	phylink_stop(dp->pl);

	dsa_port_disable_rt(dp);



	dsa_port_disable(dp);





	dev_mc_unsync(master, dev);

	dev_mc_unsync(master, dev);

	dev_uc_unsync(master, dev);

	dev_uc_unsync(master, dev);

CRA Git | Maintained and supported by SUSTech CRA and CCSE