net: gianfar: dispose irq mappings on probe failure and device removal

irq_of_parse_and_map() creates irqdomain mappings that should be
balanced with irq_dispose_mapping(). The driver never called
irq_dispose_mapping(), leaking mappings on probe failure and
device removal.

Fix by adding irq_dispose_mapping() in free_gfar_dev() and
expanding its loop from priv->num_grps to MAXGROUPS so the
error path also catches partially-initialized groups. All
irqinfo pointers are pre-initialized to NULL in gfar_of_init(),
making the NULL-guarded walk in free_gfar_dev() safe for every
scenario.

gfar_parse_group() itself is left as a simple parse function
with no resource management; cleanup is centralized in the
caller's error path.

Assisted-by: opencode:big-pickle
Fixes: b31a1d8b4151 ("gianfar: Convert gianfar to an of_platform_driver")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://patch.msgid.link/20260626225228.427392-1-rosenp@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 3271de5844f84b9385c6315d0ee2d1fff4701358..89215e1ddc2db1fbe3935f1921a7921236fbeeee 100644 (file)
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -469,10 +469,13 @@ static void free_gfar_dev(struct gfar_private *priv)
 {
        int i, j;
 
-       for (i = 0; i < priv->num_grps; i++)
+       for (i = 0; i < MAXGROUPS; i++)
                for (j = 0; j < GFAR_NUM_IRQS; j++) {
-                       kfree(priv->gfargrp[i].irqinfo[j]);
-                       priv->gfargrp[i].irqinfo[j] = NULL;
+                       if (priv->gfargrp[i].irqinfo[j]) {
+                               irq_dispose_mapping(priv->gfargrp[i].irqinfo[j]->irq);
+                               kfree(priv->gfargrp[i].irqinfo[j]);
+                               priv->gfargrp[i].irqinfo[j] = NULL;
+                       }
                }
 
        free_netdev(priv->ndev);
@@ -616,7 +619,7 @@ static phy_interface_t gfar_get_interface(struct net_device *dev)
 static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
 {
        const char *model;
-       int err = 0, i;
+       int err = 0, i, j;
        phy_interface_t interface;
        struct net_device *dev = NULL;
        struct gfar_private *priv = NULL;
@@ -702,8 +705,11 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
        priv->rx_list.count = 0;
        mutex_init(&priv->rx_queue_access);
 
-       for (i = 0; i < MAXGROUPS; i++)
+       for (i = 0; i < MAXGROUPS; i++) {
                priv->gfargrp[i].regs = NULL;
+               for (j = 0; j < GFAR_NUM_IRQS; j++)
+                       priv->gfargrp[i].irqinfo[j] = NULL;
+       }
 
        /* Parse and initialize group specific information */
        if (priv->mode == MQ_MG_MODE) {