[PATCH] net: mdio: octeon: Fix some double free issues

[PATCH] net: mdio: octeon: Fix some double free issues

[Christophe JAILLET]

'bus->mii_bus' has been allocated with 'devm_mdiobus_alloc_size()' in the
probe function. So it must not be freed explicitly or there will be a
double free.

Remove the incorrect 'mdiobus_free' in the error handling path of the
probe function and in remove function.

Suggested-By: Andrew Lunn <andrew@lunn.ch>
Fixes: 35d2aeac9810 ("phy: mdio-octeon: Use devm_mdiobus_alloc_size()")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
The 'smi_en.u64 = 0; oct_mdio_writeq()' looks odd to me. Usually the normal
path and the error handling path don't write the same value. Here, both
write 0.
Having '1' somewhere would 'look' more usual. :)
More over I think that 'smi_en.s.en = 1;' in the probe is useless.
I don't know what this code is supposed to do, so I leave it as-is.
But it looks like a left-over from a6d678645210.
---
 drivers/net/mdio/mdio-octeon.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/drivers/net/mdio/mdio-octeon.c b/drivers/net/mdio/mdio-octeon.c
index 8ce99c4888e1..e096e68ac667 100644
--- a/drivers/net/mdio/mdio-octeon.c
+++ b/drivers/net/mdio/mdio-octeon.c
@@ -71,7 +71,6 @@ static int octeon_mdiobus_probe(struct platform_device *pdev)
 
 	return 0;
 fail_register:
-	mdiobus_free(bus->mii_bus);
 	smi_en.u64 = 0;
 	oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);
 	return err;
@@ -85,7 +84,6 @@ static int octeon_mdiobus_remove(struct platform_device *pdev)
 	bus = platform_get_drvdata(pdev);
 
 	mdiobus_unregister(bus->mii_bus);
-	mdiobus_free(bus->mii_bus);
 	smi_en.u64 = 0;
 	oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);
 	return 0;
-- 
2.30.2

Re: [PATCH] net: mdio: octeon: Fix some double free issues

[Russell King - ARM Linux admin]

On Thu, May 13, 2021 at 09:24:55AM +0200, Christophe JAILLET wrote:
> 'bus->mii_bus' has been allocated with 'devm_mdiobus_alloc_size()' in the
> probe function. So it must not be freed explicitly or there will be a
> double free.
> 
> Remove the incorrect 'mdiobus_free' in the error handling path of the
> probe function and in remove function.
> 
> Suggested-By: Andrew Lunn <andrew@lunn.ch>
> Fixes: 35d2aeac9810 ("phy: mdio-octeon: Use devm_mdiobus_alloc_size()")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Reviewed-by: Russell King <rmk+kernel@armlinux.org.uk>

> ---
> The 'smi_en.u64 = 0; oct_mdio_writeq()' looks odd to me. Usually the normal
> path and the error handling path don't write the same value. Here, both
> write 0.
> Having '1' somewhere would 'look' more usual. :)
> More over I think that 'smi_en.s.en = 1;' in the probe is useless.

It looks fine to me.

        smi_en.u64 = 0;
        smi_en.s.en = 1;
        oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);

smi_en is a union of a u64 and a structure containing a bitfield. s.en
corresponds on LE systems with the u64 bit 0. So the above has the
effect of writing a u64 value of '1' to the SMI_EN register, whereas:

        smi_en.u64 = 0;
        oct_mdio_writeq(smi_en.u64, bus->register_base + SMI_EN);

has the effect of writing a u64 value of '0' to the SMI_EN register.

This code is fine.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

Re: [PATCH] net: mdio: octeon: Fix some double free issues

[Andrew Lunn]

On Thu, May 13, 2021 at 09:24:55AM +0200, Christophe JAILLET wrote:
> 'bus->mii_bus' has been allocated with 'devm_mdiobus_alloc_size()' in the
> probe function. So it must not be freed explicitly or there will be a
> double free.
> 
> Remove the incorrect 'mdiobus_free' in the error handling path of the
> probe function and in remove function.
> 
> Suggested-By: Andrew Lunn <andrew@lunn.ch>
> Fixes: 35d2aeac9810 ("phy: mdio-octeon: Use devm_mdiobus_alloc_size()")
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH] net: mdio: octeon: Fix some double free issues

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu, 13 May 2021 09:24:55 +0200 you wrote:
> 'bus->mii_bus' has been allocated with 'devm_mdiobus_alloc_size()' in the
> probe function. So it must not be freed explicitly or there will be a
> double free.
> 
> Remove the incorrect 'mdiobus_free' in the error handling path of the
> probe function and in remove function.
> 
> [...]

Here is the summary with links:
  - net: mdio: octeon: Fix some double free issues
    https://git.kernel.org/netdev/net/c/e1d027dd97e1

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html