Re: [PATCH net-next 2/2] net: stmmac: dwmac-sun8i: Enable jumbo frames up to MTU 2018

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] net: stmmac: dwmac-sun8i: use-after-free in
  sun8i_dwmac_probe() [1]
--

commit c1b9df3d167772eb81ad19c92d811c6f17d19aa6
Author: Arun Iyengar <aiyengar1990@gmail.com>

net: stmmac: dwmac-sun8i: Enable jumbo frames up to MTU 2018

This commit enables EMAC_RX_JUMBO_FRM_EN in sun8i_dwmac_core_init() and
caps plat_dat->maxmtu at 2018 bytes so frames fit within a single
normal-mode DMA descriptor buffer.

> diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
> index 0c82662fbe6ea..a18d3daf6a3ff 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c

[ ... ]

> @@ -1209,6 +1232,7 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
>  	plat_dat->mac_setup = sun8i_dwmac_setup;
>  	plat_dat->tx_fifo_size = 4096;
>  	plat_dat->rx_fifo_size = 16384;
> +	plat_dat->maxmtu = min(plat_dat->maxmtu, EMAC_MAX_MTU);
>  
>  	ret = sun8i_dwmac_set_syscon(&pdev->dev, plat_dat);
>  	if (ret)

[Severity: Critical]
This problem wasn't introduced by this patch, but can the dwmac_mux error
path in sun8i_dwmac_probe() trigger a use-after-free on gmac->ephy_clk and
gmac->rst_ephy [1]?

If sun8i_dwmac_register_mdio_mux() fails after mdio_mux_init() has switched
to and powered the internal PHY (setting gmac->internal_phy_powered = true),
jumping to dwmac_mux releases gmac->rst_ephy and gmac->ephy_clk before
calling stmmac_pltfr_remove():

drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:sun8i_dwmac_probe() {
	...
dwmac_mux:
	reset_control_put(gmac->rst_ephy);
	clk_put(gmac->ephy_clk);
dwmac_remove:
	pm_runtime_put_noidle(&pdev->dev);
	stmmac_pltfr_remove(pdev);
	...
}

stmmac_pltfr_remove() then invokes plat_dat->exit (sun8i_dwmac_exit()),
which calls sun8i_dwmac_unpower_internal_phy() and passes the freed
gmac->ephy_clk and gmac->rst_ephy pointers to clk_disable_unprepare() and
reset_control_assert().  Releasing rst_ephy and ephy_clk after
stmmac_pltfr_remove() returns would avoid this.

[1] https://sashiko.dev/#/bug/linux-00a700e2-db38-4b13-88b6-6eb44a168172

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-sun8i-emac-jumbo-v1-0-84bf00e9ffa3@gmail.com?part=2