Re: [PATCH net-next v6 1/2] net: fec: Propagate PTP initialization errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unsafe error paths leave the devm-managed PPS IRQ active while hardware clocks are disabled and `ndev` is freed.
--

commit 4a112d5fbd55881d0083cd7c88b9d35cd673b462
Author: bui duc phuc <phucduc.bui@gmail.com>

net: fec: Propagate PTP initialization errors

This commit changes fec_ptp_init() to return an error code instead of
silently ignoring failures during PTP initialization. It also propagates
failures from devm_request_irq() and ptp_clock_register().

Link: https://lore.kernel.org/all/20260909064712.22539-1-phucduc.bui@gmail.com/

> diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
> --- a/drivers/net/ethernet/freescale/fec_main.c
> +++ b/drivers/net/ethernet/freescale/fec_main.c
[ ... ]
> @@ -5384,8 +5384,11 @@ fec_probe(struct platform_device *pdev)
>  		goto failed_reset;
>  
>  	irq_cnt = fec_enet_get_irq_cnt(pdev);
> -	if (fep->bufdesc_ex)
> -		fec_ptp_init(pdev, irq_cnt);
> +	if (fep->bufdesc_ex) {
> +		ret = fec_ptp_init(pdev, irq_cnt);
> +		if (ret)
> +			goto failed_reset;

[Severity: High]
This isn't a bug introduced by this patch, but this new error path exposes a
pre-existing issue.

If fec_ptp_init() fails (for example, when ptp_clock_register() returns an
error), we jump straight to failed_reset. At this point, the PPS interrupt
has already been requested via devm_request_irq() inside fec_ptp_init().

The cleanup path under failed_reset disables hardware clocks (clk_ahb,
clk_ipg) and eventually frees ndev. Since the devm-managed IRQ is not freed
until fec_probe() returns, the interrupt remains active during this cleanup.

If a pending PPS interrupt fires during this window, fec_pps_interrupt()
will access hardware registers with clocks disabled and dereference the
freed ndev memory. Could this lead to a kernel panic or use-after-free
during a probe failure?

> +	}
>  
>  	ret = fec_enet_init(ndev);
>  	if (ret)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260911040021.12289-1-phucduc.bui@gmail.com?part=1