Re: [PATCH net-next v3 10/13] net: dsa: rzn1-a5psw: Choose tagging protocol based on compatible string

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] net: dsa: rzn1-a5psw: null pointer deref in probe on sysfs bind
- [Medium] net: dsa: tag_rzn1_a5psw: broken module auto-loading due to incorrect macro protocol ID
--

commit fb10d951639e543773ea24357094717bd055958c
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

net: dsa: rzn1-a5psw: Choose tagging protocol based on compatible string

This commit makes the DSA tag protocol selectable through SoC match data
to prepare the driver for the forthcoming RZ/T2H ETHSW support. It uses
the compatible string to select the appropriate tagging protocol while
preserving the existing RZ/N1 behavior.

> diff --git a/drivers/net/dsa/rzn1_a5psw.c b/drivers/net/dsa/rzn1_a5psw.c
> index 85ff1fd2bbfba..0b0b4055e6155 100644
> --- a/drivers/net/dsa/rzn1_a5psw.c
> +++ b/drivers/net/dsa/rzn1_a5psw.c
> @@ -1223,7 +1230,8 @@ static int a5psw_probe(struct platform_device *pdev)
>  	if (IS_ERR(a5psw->base))
>  		return PTR_ERR(a5psw->base);
>  
> -	a5psw->bridged_ports = BIT(A5PSW_CPU_PORT);
> +	a5psw->of_data = of_device_get_match_data(dev);
> +	a5psw->bridged_ports = BIT(a5psw->of_data->cpu_port);

[Severity: High]
Does this code cause a NULL pointer dereference?

If the platform device is bound via sysfs, the device is matched by driver
name rather than via device tree. In this case, of_device_get_match_data(dev)
will return NULL in a5psw_probe(), leaving a5psw->of_data as NULL.

When BIT(a5psw->of_data->cpu_port) is evaluated, it will dereference the NULL
pointer, which transforms a previously safe error path into a panic.

[ ... ]

> diff --git a/net/dsa/tag_rzn1_a5psw.c b/net/dsa/tag_rzn1_a5psw.c
> index 734910156dc33..3dff661fa58cb 100644
> --- a/net/dsa/tag_rzn1_a5psw.c
> +++ b/net/dsa/tag_rzn1_a5psw.c
> @@ -112,8 +112,24 @@ static const struct dsa_device_ops a5psw_netdev_ops = {
>  	.rcv	= a5psw_tag_rcv,
>  	.needed_headroom = A5PSW_TAG_LEN,
>  };
> +MODULE_ALIAS_DSA_TAG_DRIVER(DSA_TAG_PROTO_A5PSW, A5PSW_NAME);

[Severity: Medium]
Is this macro protocol ID correct?

The protocol macro DSA_TAG_PROTO_A5PSW does not exist. The correct macro
is DSA_TAG_PROTO_RZN1_A5PSW.

Because DSA_TAG_PROTO_A5PSW_VALUE is undefined, the C preprocessor stringifies
it literally as "DSA_TAG_PROTO_A5PSW_VALUE" rather than expanding it to "26".

This causes the module alias to be registered as
"dsa_tag:id-DSA_TAG_PROTO_A5PSW_VALUE" instead of "dsa_tag:id-26", which
breaks module auto-loading for the tag driver.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014131906.990077-1-prabhakar.mahadev-lad.rj@bp.renesas.com?part=10