[PATCH] net: enetc: Fix use after free issue in fsl_enetc.c

[Ramon Fried]

On Wed, Aug 31, 2022 at 4:49 PM Simon Glass <sjg at chromium.org> wrote:
>
> On Wed, 31 Aug 2022 at 05:20, Siarhei Yasinski
> <siarhei.yasinski at sintecs.eu> wrote:
> >
> > If ethernet connected to SFP, like this:
> >
> > &enetc_port0 {
> >             phy-connection-type = "sgmii";
> >             sfp = <&sfp0>;
> >             managed = "in-band-status";
> >             status = "okay";
> > };
> >
> > Then enetc_config_phy returns -ENODEV and the memory containing the mdio interface is freed.
> > It's better to unregister and free mdio resources.
> >
> > Signed-off-by: Siarhei Yasinski <siarhei.yasinski at sintecs.eu>
>
> Reviewed-by: Simon Glass <sjg at chromium.org>
>
> but note we normally use the var name 'ret' with driver model.
>
>
> >
> > diff --git a/drivers/net/fsl_enetc.c b/drivers/net/fsl_enetc.c
> > index cd4c2c29a6..835e5bd8bd 100644
> > --- a/drivers/net/fsl_enetc.c
> > +++ b/drivers/net/fsl_enetc.c
> > @@ -22,6 +22,8 @@
> >
> >  #define ENETC_DRIVER_NAME      "enetc_eth"
> >
> > +static int enetc_remove(struct udevice *dev);
> > +
> >  /*
> >   * sets the MAC address in IERB registers, this setting is persistent and
> >   * carried over to Linux.
> > @@ -319,6 +321,7 @@ static int enetc_config_phy(struct udevice *dev)
> >  static int enetc_probe(struct udevice *dev)
> >  {
> >         struct enetc_priv *priv = dev_get_priv(dev);
> > +       int res;
> >
> >         if (ofnode_valid(dev_ofnode(dev)) && !ofnode_is_available(dev_ofnode(dev))) {
> >                 enetc_dbg(dev, "interface disabled\n");
> > @@ -350,7 +353,10 @@ static int enetc_probe(struct udevice *dev)
> >
> >         enetc_start_pcs(dev);
> >
> > -       return enetc_config_phy(dev);
> > +       res = enetc_config_phy(dev);
> > +       if(res)
> > +               enetc_remove(dev);
> > +       return res;
> >  }
> >
> >  /*
Reviewed-by: Ramon Fried <rfried.dev at gmail.com>