kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
David Oberhollenzer 0ae509b075 net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy 
[ Upstream commit a58d882841 ]

The mv88e6xxx has an internal PPU that polls PHY state. If we want to
access the internal PHYs, we need to disable the PPU first. Because
that is a slow operation, a 10ms timer is used to re-enable it,
canceled with every access, so bulk operations effectively only
disable it once and re-enable it some 10ms after the last access.

If a PHY is accessed and then the mv88e6xxx module is removed before
the 10ms are up, the PPU re-enable ends up accessing a dangling pointer.

This especially affects probing during bootup. The MDIO bus and PHY
registration may succeed, but registration with the DSA framework
may fail later on (e.g. because the CPU port depends on another,
very slow device that isn't done probing yet, returning -EPROBE_DEFER).
In this case, probe() fails, but the MDIO subsystem may already have
accessed the MIDO bus or PHYs, arming the timer.

This is fixed as follows:
 - If probe fails after mv88e6xxx_phy_init(), make sure we also call
   mv88e6xxx_phy_destroy() before returning
 - In mv88e6xxx_remove(), make sure we do the teardown in the correct
   order, calling mv88e6xxx_phy_destroy() after unregistering the
   switch device.
 - In mv88e6xxx_phy_destroy(), destroy both the timer and the work item
   that the timer might schedule, synchronously waiting in case one of
   the callbacks already fired and destroying the timer first, before
   waiting for the work item.
 - Access to the PPU is guarded by a mutex, the worker acquires it
   with a mutex_trylock(), not proceeding with the expensive shutdown
   if that fails. We grab the mutex in mv88e6xxx_phy_destroy() to make
   sure the slow PPU shutdown is already done or won't even enter, when
   we wait for the work item.

Fixes: 2e5f032095 ("dsa: add support for the Marvell 88E6131 switch chip")
Signed-off-by: David Oberhollenzer <david.oberhollenzer@sigma-star.at>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Link: https://patch.msgid.link/20250401135705.92760-1-david.oberhollenzer@sigma-star.at
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-04-10 14:37:40 +02:00
..
accel accel/qaic: Fix integer overflow in qaic_validate_req() 2025-03-28 21:59:54 +01:00
accessibility speakup: Fix sizeof() vs ARRAY_SIZE() bug 2024-06-12 11:11:18 +02:00
acpi ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid 2025-04-10 14:37:36 +02:00
amba amba: bus: fix refcount leak 2023-08-22 15:50:57 +02:00
android binder: fix UAF caused by offsets overwrite 2024-09-12 11:11:41 +02:00
ata ata: libata-sff: Ensure that we cannot write outside the allocated buffer 2025-02-17 09:40:35 +01:00
atm atm: idt77252: prevent use after free in dequeue_rx() 2024-08-29 17:33:18 +02:00
auxdisplay auxdisplay: ht16k33: Drop reference after LED registration 2024-08-03 08:54:39 +02:00
base PM: sleep: Fix handling devices with direct_complete set on errors 2025-04-10 14:37:26 +02:00
bcma bcma: Add explicit of_device.h include 2023-04-14 15:32:56 +03:00
block zram: fix NULL pointer in comp_algorithm_show() 2025-03-22 12:50:37 -07:00
bluetooth bluetooth: btusb: Initialize .owner field of force_poll_sync_fops 2025-03-13 12:58:28 +01:00
bus bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock 2025-03-13 12:58:37 +01:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() 2024-11-01 01:58:25 +01:00
cdx cdx: Fix possible UAF error in driver_override_show() 2025-03-13 12:58:36 +01:00
char char: misc: deallocate static minor in error path 2025-03-13 12:58:37 +01:00
clk clk: qcom: mmcc-sdm660: fix stuck video_subcore0 clock 2025-04-10 14:37:32 +02:00
clocksource clockevents/drivers/i8253: Fix stop sequence for timer 0 2025-03-22 12:50:37 -07:00
comedi comedi: Flush partial mappings in error case 2024-12-09 10:32:44 +01:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter counter: microchip-tcb-capture: Fix undefined counter channel state on probe 2025-04-07 10:06:37 +02:00
cpufreq cpufreq: governor: Fix negative 'idle_time' handling in dbs_update() 2025-04-10 14:37:25 +02:00
cpuidle cpuidle: riscv-sbi: fix device node release in early exit of for_each_possible_cpu 2025-01-17 13:36:16 +01:00
crypto crypto: hisilicon/sec2 - fix for aead auth key length 2025-04-10 14:37:32 +02:00
cxl cxl/region: Fix region creation for greater than x2 switches 2024-12-27 13:58:46 +01:00
dax dax: delete a stale directory pmem 2024-12-09 10:32:21 +01:00
dca Mainly singleton patches all over the place. Series of note are: 2023-04-27 19:57:00 -07:00
devfreq PM / devfreq: Synchronize devfreq_monitor_[start/stop] 2024-02-05 20:14:15 +00:00
dio drivers: dio: fix possible memory leak in dio_init() 2022-11-09 15:12:37 +01:00
dma dmaengine: fsl-edma: cleanup chan after dma_async_device_unregister 2025-04-10 14:37:33 +02:00
dma-buf udmabuf: also check for F_SEAL_FUTURE_WRITE 2024-12-27 13:58:56 +01:00
edac EDAC/ie31200: Fix the error path order of ie31200_init() 2025-04-10 14:37:26 +02:00
eisa EISA: Replace all non-returning strlcpy with strscpy 2023-07-27 10:04:42 -07:00
extcon extcon: max8997: select IRQ_DOMAIN instead of depending on it 2024-06-12 11:12:27 +02:00
firewire firewire: core: correct range of block for case of switch statement 2024-10-04 16:29:28 +02:00
firmware firmware: cs_dsp: Ensure cs_dsp_load[_coeff]() returns 0 on success 2025-04-10 14:37:39 +02:00
fpga fpga: region: add owner module and take its refcount 2024-06-12 11:12:23 +02:00
fsi fsi: i2cr: Switch to use struct i2c_driver's .probe() 2023-08-22 15:51:33 +02:00
gnss driver core: class: remove module * from class_create() 2023-03-17 15:16:33 +01:00
gpio gpio: rcar: Fix missing of_node_put() call 2025-03-13 12:58:33 +01:00
gpu drm/amd: Keep display off while going into S4 2025-04-10 14:37:38 +02:00
greybus greybus: Fix use-after-free bug in gb_interface_release due to race condition. 2024-06-21 14:38:48 +02:00
hid HID: i2c-hid: improve i2c_hid_get_report error message 2025-04-10 14:37:37 +02:00
hsi hsi: omap_ssi: Explicitly include correct DT includes 2023-07-31 23:17:57 +02:00
hte hte: tegra: Fix missing error code in tegra_hte_test_probe() 2023-11-20 11:59:08 +01:00
hv Drivers: hv: vmbus: Don't release fb_mmio resource in vmbus_free_mmio() 2025-03-22 12:50:38 -07:00
hwmon hwmon: (nct6775-core) Fix out of bounds access for NCT679{8,9} 2025-04-10 14:37:38 +02:00
hwspinlock hwspinlock: Introduce hwspin_lock_bust() 2024-09-08 07:54:43 +02:00
hwtracing coresight-etm4x: add isb() before reading the TRCSTATR 2025-04-10 14:37:32 +02:00
i2c i2c: omap: fix IRQ storms 2025-03-28 21:59:54 +01:00
i3c i3c: master: svc: Fix missing the IBI rules 2025-04-10 14:37:34 +02:00
idle intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly 2025-03-07 16:45:49 +01:00
iio iio: adc: ad7124: Fix comparison of channel configs 2025-04-10 14:37:33 +02:00
infiniband RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow 2025-04-10 14:37:31 +02:00
input Input: i8042 - swap old quirk combination with new quirk for more devices 2025-03-22 12:50:46 -07:00
interconnect interconnect: icc-clk: Add missed num_nodes initialization 2024-10-04 16:29:40 +02:00
iommu iommu/arm-smmu-v3: Clean up more on probe failure 2025-02-17 09:40:09 +01:00
ipack tty: make tty_operations::write()'s count size_t 2023-08-11 21:12:46 +02:00
irqchip irqchip/apple-aic: Only handle PMC interrupt as FIQ when configured so 2025-02-17 09:40:38 +01:00
isdn mISDN: fix MISDN_TIME_STAMP handling 2024-08-19 06:04:28 +02:00
leds leds: Fix LED_OFF brightness race 2025-04-10 14:37:32 +02:00
macintosh macintosh/therm_windtunnel: fix module unload. 2024-08-03 08:54:02 +02:00
mailbox mailbox: tegra-hsp: Clear mailbox before using message 2025-02-17 09:40:38 +01:00
mcb mcb: fix error handling for different scenarios when parsing 2023-11-28 17:20:05 +00:00
md dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature 2025-03-22 12:50:47 -07:00
media objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() 2025-04-10 14:37:35 +02:00
memory memory: omap-gpmc: drop no compatible check 2025-04-10 14:37:38 +02:00
memstick memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove 2025-04-07 10:06:37 +02:00
message scsi: fusion: Remove unused variable 'rc' 2024-12-09 10:32:18 +01:00
mfd mfd: sm501: Switch to BIT() to mitigate integer overflows 2025-04-10 14:37:32 +02:00
misc eeprom: digsy_mtc: Make GPIO lookup table match the device 2025-03-13 12:58:37 +01:00
mmc mmc: atmel-mci: Add missing clk_disable_unprepare() 2025-03-28 21:59:54 +01:00
most staging: most: Replace all non-returning strlcpy with strscpy 2023-06-01 07:07:37 -07:00
mtd mtd: rawnand: cadence: fix incorrect device in dma_unmap_single 2025-02-27 04:10:53 -08:00
mux mux: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
net net: dsa: mv88e6xxx: propperly shutdown PPU re-enable timer on destroy 2025-04-10 14:37:40 +02:00
nfc nfc: pn533: Add poll mod list filling check 2024-09-04 13:28:28 +02:00
ntb ntb: intel: Fix using link status DB's 2025-04-10 14:37:39 +02:00
nubus nubus: Don't list slot resources by default 2023-05-22 13:51:56 +02:00
nvdimm nvdimm: rectify the illogical code within nd_dax_probe() 2024-12-14 20:00:13 +01:00
nvme nvme-pci: fix stuck reset on concurrent DPC and HP 2025-04-10 14:37:38 +02:00
nvmem nvmem: imx-ocotp-ele: fix MAC address byte order 2025-02-27 04:10:47 -08:00
of Revert "of: reserved-memory: Fix using wrong number of cells to get property 'alignment'" 2025-03-13 12:58:22 +01:00
opp OPP: OF: Fix an OF node leak in _opp_add_static_v2() 2025-02-08 09:51:55 +01:00
parisc Revert "change alloc_pages name in dma_map_ops to avoid name conflicts" 2024-09-04 13:28:24 +02:00
parport parport: Proper fix for array out-of-bounds access 2024-10-22 15:46:33 +02:00
pci PCI: pciehp: Don't enable HPIE when resuming in poll mode 2025-04-10 14:37:29 +02:00
pcmcia pcmcia: Use resource_size function on resource object 2024-09-12 11:11:31 +02:00
peci Update peci-next for v6.6-rc1 2023-08-08 10:53:30 +02:00
perf perf/arm-cmn: Ensure port and device id bits are set properly 2024-12-09 10:32:57 +01:00
phy phy: exynos5-usbdrd: fix MPLL_MULTIPLIER and SSC_REFCLKSEL masks in refclk 2025-03-07 16:45:47 +01:00
pinctrl pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() 2025-04-10 14:37:32 +02:00
platform platform/x86/intel/vsec: Add Diamond Rapids support 2025-04-10 14:37:37 +02:00
pmdomain pmdomain: imx8mp-blk-ctrl: add missing loop break condition 2025-01-23 17:21:17 +01:00
pnp PNP: ACPI: fix fortify warning 2024-02-05 20:14:15 +00:00
power power: supply: max77693: Fix wrong conversion of charge input threshold value 2025-04-10 14:37:31 +02:00
powercap powercap: call put_device() on an error path in powercap_register_control_type() 2025-03-22 12:50:40 -07:00
pps pps: Fix a use-after-free 2025-02-08 09:52:38 +01:00
ps3 driver/ps3: Include <video/cmdline.h> for mode parsing 2023-02-20 14:56:51 +01:00
ptp ptp: Ensure info->enable callback is always set 2025-02-17 09:40:41 +01:00
pwm pwm: microchip-core: fix incorrect comparison with max period 2025-02-17 09:40:31 +01:00
rapidio rapidio: fix an API misues when rio_add_net() fails 2025-03-13 12:58:27 +01:00
ras ras/debugfs: Fix error checking for debugfs_create_dir() 2023-05-16 21:12:23 +02:00
regulator regulator: check that dummy regulator has been probed before using it 2025-03-28 21:59:54 +01:00
remoteproc remoteproc: qcom_q6v5_mss: Handle platforms with one power domain 2025-04-10 14:37:31 +02:00
reset reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC 2025-04-07 10:06:36 +02:00
rpmsg rpmsg: glink: use only lower 16-bits of param2 for CMD_OPEN name length 2024-12-09 10:32:29 +01:00
rtc rtc: zynqmp: Fix optional clock name property 2025-02-17 09:40:41 +01:00
s390 s390/cio: Fix CHPID "configure" attribute caching 2025-03-22 12:50:42 -07:00
sbus sbus: Explicitly include correct DT includes 2023-08-28 13:36:24 -05:00
scsi scsi: qla1280: Fix kernel oops when debug level > 2 2025-03-22 12:50:40 -07:00
sh sh: intc: Fix use-after-free bug in register_intc_controller() 2024-12-09 10:33:00 +01:00
siox siox: fix possible memory leak in siox_device_add() 2022-11-09 15:40:14 +01:00
slimbus slimbus: messaging: Free transaction ID in delayed interrupt scenario 2025-03-13 12:58:37 +01:00
soc soc: qcom: pdr: Fix the potential deadlock 2025-03-28 21:59:55 +01:00
soundwire soundwire: slave: fix an OF node reference leak in soundwire slave device 2025-04-10 14:37:32 +02:00
spi spi-mxs: Fix chipselect glitch 2025-03-13 12:58:40 +01:00
spmi spmi: hisi-spmi-controller: Do not override device identifier 2024-06-21 14:38:40 +02:00
ssb ssb: Fix division by zero issue in ssb_calc_clock_rate 2024-08-29 17:33:22 +02:00
staging staging: rtl8723bs: select CONFIG_CRYPTO_LIB_AES 2025-04-10 14:37:34 +02:00
target scsi: target: core: Fix null-ptr-deref in target_alloc_device() 2024-11-01 01:58:24 +01:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee tee: optee: Fix supplicant wait loop 2025-02-27 04:10:51 -08:00
thermal thermal: int340x: Add NULL check for adev 2025-04-10 14:37:26 +02:00
thunderbolt thunderbolt: Don't display nvm_version unless upgrade supported 2025-01-09 13:31:49 +01:00
tty tty: n_tty: use uint for space returned by tty_write_room() 2025-04-10 14:37:34 +02:00
ufs scsi: ufs: qcom: Only free platform MSIs when ESI is enabled 2025-04-07 10:06:36 +02:00
uio Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic 2024-09-12 11:11:41 +02:00
usb usb: xhci: correct debug message page size calculation 2025-04-10 14:37:33 +02:00
vdpa vdpa/mlx5: Fix suboptimal range on iotlb iteration 2024-12-09 10:32:30 +01:00
vfio Revert "vfio/platform: check the bounds of read/write syscalls" 2025-02-21 13:57:27 +01:00
vhost vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint 2025-04-10 14:37:32 +02:00
video fbdev: sm501fb: Add some geometry checks. 2025-04-10 14:37:29 +02:00
virt drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl 2025-03-13 12:58:37 +01:00
virtio virtio_ring: fix KMSAN error for premapped mode 2024-09-12 11:11:36 +02:00
vlynq bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
w1 nvmem: add explicit config option to read old syntax fixed OF cells 2024-05-17 12:01:55 +02:00
watchdog watchdog: rti_wdt: Fix an OF node leak in rti_wdt_probe() 2025-02-08 09:52:25 +01:00
xen Xen/swiotlb: mark xen_swiotlb_fixup() __init 2025-03-22 12:50:42 -07:00
zorro zorro: Include zorro.h in names.c 2023-08-21 13:27:44 +02:00
Kconfig Merge patch series "Add non-coherent DMA support for AX45MP" 2023-09-08 11:24:34 -07:00
Makefile pmdomain: Rename the genpd subsystem to pmdomain 2023-09-13 11:09:21 +02:00