Re: [PATCH net-next v4 10/10] net: ethernet: ravb: Add gPTP support for Gen4

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Medium] Memory leak of the OF node reference `priv->of_gptp` on `ravb_probe()` error paths.

Pre-existing issues:
- [High] Early return on `pm_runtime_resume_and_get()` failure in `ravb_remove()` bypasses all device unregistration and cleanup, causing Use-After-Free (UAF) and memory leaks.
--

commit 48076f5d1eda0f850642f3a64b86b20eefb56947
Author: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>

net: ethernet: ravb: Add gPTP support for Gen4

This commit adds gPTP support for R-Car Gen4 devices by utilizing a
system-wide gPTP clock. It adds the ptp-timer property parsing and modifies
device initialization and teardown to manage the external clock reference.

> diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
> index 8617c30dbb14e..c8aa40136c3da 100644
> --- a/drivers/net/ethernet/renesas/ravb_main.c
> +++ b/drivers/net/ethernet/renesas/ravb_main.c
> @@ -2755,6 +2755,57 @@ static const struct ravb_hw_info ravb_gen3_hw_info = {
>  	.magic_pkt = 1,
>  };
>  
> +static int ravb_gen4_ptp_probe(struct net_device *ndev)
> +{
> +	struct ravb_private *priv = netdev_priv(ndev);
> +
> +	priv->of_gptp = of_parse_phandle(priv->pdev->dev.of_node, "ptp-timer", 0);

[Severity: Medium]
Does this code leak the device node reference on error paths?

In ravb_probe(), this new ravb_gen4_ptp_probe() is called via
info->ptp->probe(ndev) and acquires the reference.

If a subsequent step in ravb_probe() fails (for example,
devm_clk_get_optional() or register_netdev()), the function jumps to shared
error labels like out_reset_assert or out_rpm_disable.

None of these error paths call of_node_put(priv->of_gptp), which leaves the
node reference permanently leaked.

> +	if (!priv->of_gptp)
> +		return 0;
> +
> +	if (!of_device_is_available(priv->of_gptp)) {
> +		of_node_put(priv->of_gptp);
> +		priv->of_gptp = NULL;
> +	}
> +
> +	return 0;
> +}

[ ... ]

> @@ -3191,6 +3242,7 @@ static void ravb_remove(struct platform_device *pdev)
>  	pm_runtime_disable(&pdev->dev);
>  	pm_runtime_dont_use_autosuspend(dev);
>  	clk_unprepare(priv->refclk);
> +	of_node_put(priv->of_gptp);

[Severity: High]
This is a pre-existing issue, but does the early return in ravb_remove()
cause a use-after-free and memory leaks?

Earlier in ravb_remove(), there is an early return if
pm_runtime_resume_and_get() fails:

	error = pm_runtime_resume_and_get(dev);
	if (error < 0)
		return;

When this fails, ravb_remove() abruptly returns without calling
unregister_netdev() or any teardown logic.

Since the driver unbinds anyway, devres will automatically unmap the device
memory (e.g., priv->addr).

However, because unregister_netdev() was skipped, the network device remains
active and will attempt to access the unmapped memory during network operations
or interrupts, leading to a kernel crash.

Additionally, this early return will also skip the newly added
of_node_put(priv->of_gptp) call, leaking the OF node reference.

>  	reset_control_assert(priv->rstc);
>  	free_netdev(ndev);
>  	platform_set_drvdata(pdev, NULL);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909173027.2201560-1-niklas.soderlund+renesas@ragnatech.se?part=10