[PATCH net-next] net: dsa: mv88e6xxx: clean up PTP clock during setup failure

[PATCH net-next] net: dsa: mv88e6xxx: clean up PTP clock during setup failure

[Russell King (Oracle)]

If an error occurs during mv88e6xxx_setup() and the PTP clock has been
registered, the clock will not be unregistered as mv88e6xxx_ptp_free()
will not be called. mv88e6xxx_hwtstamp_free() also is not called.

As mv88e6xxx_ptp_free() can cope with being called without a successful
call to mv88e6xxx_ptp_setup(), and mv88e6xxx_hwtstamp_free() is empty,
add both these *_free() calls to the error cleanup paths in
mv88e6xxx_setup().

Moreover, mv88e6xxx_teardown() should teardown setup done in
mv88e6xxx_setup() - see dsa_switch_setup(). However, instead *_free()
are called from mv88e6xxx_remove() function that is only called when a
device is unbound, which omits cleanup should a failure occur later in
dsa_switch_setup(). Move the *_free() calls from mv88e6xxx_remove() to
mv88e6xxx_teardown().

Note that mv88e6xxx_ptp_setup() must be called holding the reg_lock,
but mv88e6xxx_ptp_free() must never be. This is especially true after
commit "ptp: rework ptp_clock_unregister() to disable events". This
patch does not change this, but adds a comment to that effect.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
---
This is a long-standing bug, and I don't think it makes sense to rush
it in via the net tree as a failure to trigger it is very unlikely to
happen.

 drivers/net/dsa/mv88e6xxx/chip.c | 15 +++++++--------
 drivers/net/dsa/mv88e6xxx/ptp.c  |  1 +
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 25d4c89d36b8..b4d48997bf46 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3965,6 +3965,8 @@ static void mv88e6xxx_teardown(struct dsa_switch *ds)
 	mv88e6xxx_teardown_devlink_params(ds);
 	dsa_devlink_resources_unregister(ds);
 	mv88e6xxx_teardown_devlink_regions_global(ds);
+	mv88e6xxx_hwtstamp_free(chip);
+	mv88e6xxx_ptp_free(chip);
 	mv88e6xxx_mdios_unregister(chip);
 }
 
@@ -4105,7 +4107,7 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
 	mv88e6xxx_reg_unlock(chip);
 
 	if (err)
-		goto out_mdios;
+		goto out_hwtstamp;
 
 	/* Have to be called without holding the register lock, since
 	 * they take the devlink lock, and we later take the locks in
@@ -4114,7 +4116,7 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
 	 */
 	err = mv88e6xxx_setup_devlink_resources(ds);
 	if (err)
-		goto out_mdios;
+		goto out_hwtstamp;
 
 	err = mv88e6xxx_setup_devlink_params(ds);
 	if (err)
@@ -4130,7 +4132,9 @@ static int mv88e6xxx_setup(struct dsa_switch *ds)
 	mv88e6xxx_teardown_devlink_params(ds);
 out_resources:
 	dsa_devlink_resources_unregister(ds);
-out_mdios:
+out_hwtstamp:
+	mv88e6xxx_hwtstamp_free(chip);
+	mv88e6xxx_ptp_free(chip);
 	mv88e6xxx_mdios_unregister(chip);
 
 	return err;
@@ -7439,11 +7443,6 @@ static void mv88e6xxx_remove(struct mdio_device *mdiodev)
 
 	chip = ds->priv;
 
-	if (chip->info->ptp_support) {
-		mv88e6xxx_hwtstamp_free(chip);
-		mv88e6xxx_ptp_free(chip);
-	}
-
 	mv88e6xxx_unregister_switch(chip);
 
 	mv88e6xxx_g1_vtu_prob_irq_free(chip);
diff --git a/drivers/net/dsa/mv88e6xxx/ptp.c b/drivers/net/dsa/mv88e6xxx/ptp.c
index 89fb61ea891d..fa17ad6e378f 100644
--- a/drivers/net/dsa/mv88e6xxx/ptp.c
+++ b/drivers/net/dsa/mv88e6xxx/ptp.c
@@ -551,6 +551,7 @@ int mv88e6xxx_ptp_setup(struct mv88e6xxx_chip *chip)
 	return 0;
 }
 
+/* This must never be called holding the register lock */
 void mv88e6xxx_ptp_free(struct mv88e6xxx_chip *chip)
 {
 	if (chip->ptp_clock) {
-- 
2.47.3

Re: [PATCH net-next] net: dsa: mv88e6xxx: clean up PTP clock during setup failure

[Vladimir Oltean]

On Mon, Sep 15, 2025 at 01:13:06PM +0100, Russell King (Oracle) wrote:
> If an error occurs during mv88e6xxx_setup() and the PTP clock has been
> registered, the clock will not be unregistered as mv88e6xxx_ptp_free()
> will not be called. mv88e6xxx_hwtstamp_free() also is not called.
> 
> As mv88e6xxx_ptp_free() can cope with being called without a successful
> call to mv88e6xxx_ptp_setup(), and mv88e6xxx_hwtstamp_free() is empty,
> add both these *_free() calls to the error cleanup paths in
> mv88e6xxx_setup().
> 
> Moreover, mv88e6xxx_teardown() should teardown setup done in
> mv88e6xxx_setup() - see dsa_switch_setup(). However, instead *_free()
> are called from mv88e6xxx_remove() function that is only called when a
> device is unbound, which omits cleanup should a failure occur later in
> dsa_switch_setup(). Move the *_free() calls from mv88e6xxx_remove() to
> mv88e6xxx_teardown().
> 
> Note that mv88e6xxx_ptp_setup() must be called holding the reg_lock,
> but mv88e6xxx_ptp_free() must never be. This is especially true after
> commit "ptp: rework ptp_clock_unregister() to disable events". This
> patch does not change this, but adds a comment to that effect.
> 
> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
> ---

Reviewed-by: Vladimir Oltean <olteanv@gmail.com>

Re: [PATCH net-next] net: dsa: mv88e6xxx: clean up PTP clock during setup failure

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 15 Sep 2025 13:13:06 +0100 you wrote:
> If an error occurs during mv88e6xxx_setup() and the PTP clock has been
> registered, the clock will not be unregistered as mv88e6xxx_ptp_free()
> will not be called. mv88e6xxx_hwtstamp_free() also is not called.
> 
> As mv88e6xxx_ptp_free() can cope with being called without a successful
> call to mv88e6xxx_ptp_setup(), and mv88e6xxx_hwtstamp_free() is empty,
> add both these *_free() calls to the error cleanup paths in
> mv88e6xxx_setup().
> 
> [...]

Here is the summary with links:
  - [net-next] net: dsa: mv88e6xxx: clean up PTP clock during setup failure
    https://git.kernel.org/netdev/net-next/c/c94ef36ec9d1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html