Re: [PATCH net] net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] net: stmmac: dwmac-sun8i: unhandled -EPROBE_DEFER in
  get_ephy_nodes() [1]
--

commit 0e3757128b0330be69abe1ee1230d93499f349af
Author: Arun Iyengar <aiyengar1990@gmail.com>

net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

This commit unpowers the internal PHY on the sun8i_dwmac_probe() MDIO mux
error path before releasing gmac->rst_ephy and gmac->ephy_clk so that the
subsequent sun8i_dwmac_exit() call does not access freed resources.

> diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
> index 47954537b29e4..4436532af2dce 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
> @@ -1245,6 +1245,7 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
>  	return 0;
>  
>  dwmac_mux:
> +	sun8i_dwmac_unpower_internal_phy(gmac);
>  	reset_control_put(gmac->rst_ephy);
>  	clk_put(gmac->ephy_clk);
>  dwmac_remove:

[Severity: High]
This problem wasn't introduced by this patch, but does get_ephy_nodes()
swallow -EPROBE_DEFER when acquiring ephy_clk [1]?

drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c:get_ephy_nodes() {
	...
	for_each_child_of_node_scoped(mdio_internal, iphynode) {
		struct clk *ephy_clk;

		ephy_clk = of_clk_get(iphynode, 0);
		if (IS_ERR(ephy_clk))
			continue;
		gmac->rst_ephy = of_reset_control_get_exclusive(iphynode, NULL);
		if (IS_ERR(gmac->rst_ephy)) {
			ret = PTR_ERR(gmac->rst_ephy);
			clk_put(ephy_clk);
			if (ret == -EPROBE_DEFER) {
				of_node_put(mdio_internal);
				return ret;
			}
			continue;
		}
	...
	of_node_put(mdio_internal);
	return -ENODEV;
}

Unlike the of_reset_control_get_exclusive() check right below it, an
IS_ERR(ephy_clk) result unconditionally continues the loop without checking
for -EPROBE_DEFER.  If the internal PHY clock provider is not registered
yet during boot, get_ephy_nodes() exhausts the child nodes and returns
-ENODEV, causing sun8i_dwmac_probe() to fail permanently instead of
deferring probe.

[1] https://sashiko.dev/#/bug/linux-98384c14-541e-410e-a074-fff5e98b3820

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-sun8i-emac-mux-uaf-v1-1-308ae7e6fcf2@gmail.com?part=1