net: dsa: fix phylink_start()/phylink_stop() calls
Place phylink_start()/phylink_stop() inside dsa_port_enable() and
dsa_port_disable(), which ensures that we call phylink_stop() before
tearing down phylink - which is a documented requirement. Failure
to do so can cause use-after-free bugs.
Fixes: 0e27921816
("net: dsa: Use PHYLINK for the CPU/DSA ports")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
f650bcd4ef
commit
8640f8dc6d
|
@ -117,7 +117,9 @@ static inline struct net_device *dsa_master_find_slave(struct net_device *dev,
|
|||
/* port.c */
|
||||
int dsa_port_set_state(struct dsa_port *dp, u8 state,
|
||||
struct switchdev_trans *trans);
|
||||
int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy);
|
||||
int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy);
|
||||
void dsa_port_disable_rt(struct dsa_port *dp);
|
||||
void dsa_port_disable(struct dsa_port *dp);
|
||||
int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br);
|
||||
void dsa_port_bridge_leave(struct dsa_port *dp, struct net_device *br);
|
||||
|
|
|
@ -63,7 +63,7 @@ static void dsa_port_set_state_now(struct dsa_port *dp, u8 state)
|
|||
pr_err("DSA: failed to set STP state %u (%d)\n", state, err);
|
||||
}
|
||||
|
||||
int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
|
||||
int dsa_port_enable_rt(struct dsa_port *dp, struct phy_device *phy)
|
||||
{
|
||||
struct dsa_switch *ds = dp->ds;
|
||||
int port = dp->index;
|
||||
|
@ -78,14 +78,31 @@ int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
|
|||
if (!dp->bridge_dev)
|
||||
dsa_port_set_state_now(dp, BR_STATE_FORWARDING);
|
||||
|
||||
if (dp->pl)
|
||||
phylink_start(dp->pl);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void dsa_port_disable(struct dsa_port *dp)
|
||||
int dsa_port_enable(struct dsa_port *dp, struct phy_device *phy)
|
||||
{
|
||||
int err;
|
||||
|
||||
rtnl_lock();
|
||||
err = dsa_port_enable_rt(dp, phy);
|
||||
rtnl_unlock();
|
||||
|
||||
return err;
|
||||
}
|
||||
|
||||
void dsa_port_disable_rt(struct dsa_port *dp)
|
||||
{
|
||||
struct dsa_switch *ds = dp->ds;
|
||||
int port = dp->index;
|
||||
|
||||
if (dp->pl)
|
||||
phylink_stop(dp->pl);
|
||||
|
||||
if (!dp->bridge_dev)
|
||||
dsa_port_set_state_now(dp, BR_STATE_DISABLED);
|
||||
|
||||
|
@ -93,6 +110,13 @@ void dsa_port_disable(struct dsa_port *dp)
|
|||
ds->ops->port_disable(ds, port);
|
||||
}
|
||||
|
||||
void dsa_port_disable(struct dsa_port *dp)
|
||||
{
|
||||
rtnl_lock();
|
||||
dsa_port_disable_rt(dp);
|
||||
rtnl_unlock();
|
||||
}
|
||||
|
||||
int dsa_port_bridge_join(struct dsa_port *dp, struct net_device *br)
|
||||
{
|
||||
struct dsa_notifier_bridge_info info = {
|
||||
|
@ -614,10 +638,6 @@ static int dsa_port_phylink_register(struct dsa_port *dp)
|
|||
goto err_phy_connect;
|
||||
}
|
||||
|
||||
rtnl_lock();
|
||||
phylink_start(dp->pl);
|
||||
rtnl_unlock();
|
||||
|
||||
return 0;
|
||||
|
||||
err_phy_connect:
|
||||
|
|
|
@ -88,12 +88,10 @@ static int dsa_slave_open(struct net_device *dev)
|
|||
goto clear_allmulti;
|
||||
}
|
||||
|
||||
err = dsa_port_enable(dp, dev->phydev);
|
||||
err = dsa_port_enable_rt(dp, dev->phydev);
|
||||
if (err)
|
||||
goto clear_promisc;
|
||||
|
||||
phylink_start(dp->pl);
|
||||
|
||||
return 0;
|
||||
|
||||
clear_promisc:
|
||||
|
@ -114,9 +112,7 @@ static int dsa_slave_close(struct net_device *dev)
|
|||
struct net_device *master = dsa_slave_to_master(dev);
|
||||
struct dsa_port *dp = dsa_slave_to_port(dev);
|
||||
|
||||
phylink_stop(dp->pl);
|
||||
|
||||
dsa_port_disable(dp);
|
||||
dsa_port_disable_rt(dp);
|
||||
|
||||
dev_mc_unsync(master, dev);
|
||||
dev_uc_unsync(master, dev);
|
||||
|
|
Loading…
Reference in New Issue