--- /dev/null
+From 05e090620bacf317020f9591cfff8926093380bd Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Fri, 24 Oct 2025 14:23:35 +0300
+Subject: [PATCH] net: airoha: Fix a copy and paste bug in probe()
+
+This code has a copy and paste bug where it accidentally checks "if (err)"
+instead of checking if "xsi_rsts" is NULL. Also, as a free bonus, I
+changed the allocation from kzalloc() to kcalloc() which is a kernel
+hardening measure to protect against integer overflows.
+
+Fixes: 5863b4e065e2 ("net: airoha: Add airoha_eth_soc_data struct")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/aPtht6y5DRokn9zv@stanley.mountain
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -2990,11 +2990,11 @@ static int airoha_probe(struct platform_
+ return err;
+ }
+
+- xsi_rsts = devm_kzalloc(eth->dev,
+- eth->soc->num_xsi_rsts * sizeof(*xsi_rsts),
++ xsi_rsts = devm_kcalloc(eth->dev,
++ eth->soc->num_xsi_rsts, sizeof(*xsi_rsts),
+ GFP_KERNEL);
+- if (err)
+- return err;
++ if (!xsi_rsts)
++ return -ENOMEM;
+
+ eth->xsi_rsts = xsi_rsts;
+ for (i = 0; i < eth->soc->num_xsi_rsts; i++)
--- /dev/null
+From 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 25 Jun 2025 16:43:15 +0200
+Subject: [PATCH] net: airoha: Get rid of dma_sync_single_for_device() in
+ airoha_qdma_fill_rx_queue()
+
+Since the page_pool for airoha_eth driver is created with
+PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page
+received from the pool since it is already done by the page_pool codebase.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Link: https://patch.msgid.link/20250625-airoha-sync-for-device-v1-1-923741deaabf@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -539,9 +539,7 @@ static int airoha_fe_init(struct airoha_
+
+ static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
+ {
+- enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
+ struct airoha_qdma *qdma = q->qdma;
+- struct airoha_eth *eth = qdma->eth;
+ int qid = q - &qdma->q_rx[0];
+ int nframes = 0;
+
+@@ -565,9 +563,6 @@ static int airoha_qdma_fill_rx_queue(str
+ e->dma_addr = page_pool_get_dma_addr(page) + offset;
+ e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
+
+- dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
+- dir);
+-
+ val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
+ WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
+ WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));
--- /dev/null
+From 3cd582e7d0787506990ef0180405eb6224fa90a6 Mon Sep 17 00:00:00 2001
+From: Alok Tiwari <alok.a.tiwari@oracle.com>
+Date: Tue, 15 Jul 2025 07:30:58 -0700
+Subject: [PATCH] net: airoha: fix potential use-after-free in airoha_npu_get()
+
+np->name was being used after calling of_node_put(np), which
+releases the node and can lead to a use-after-free bug.
+Previously, of_node_put(np) was called unconditionally after
+of_find_device_by_node(np), which could result in a use-after-free if
+pdev is NULL.
+
+This patch moves of_node_put(np) after the error check to ensure
+the node is only released after both the error and success cases
+are handled appropriately, preventing potential resource issues.
+
+Fixes: 23290c7bc190 ("net: airoha: Introduce Airoha NPU support")
+Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250715143102.3458286-1-alok.a.tiwari@oracle.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/airoha/airoha_npu.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_npu.c
++++ b/drivers/net/ethernet/airoha/airoha_npu.c
+@@ -567,12 +567,13 @@ struct airoha_npu *airoha_npu_get(struct
+ return ERR_PTR(-ENODEV);
+
+ pdev = of_find_device_by_node(np);
+- of_node_put(np);
+
+ if (!pdev) {
+ dev_err(dev, "cannot find device node %s\n", np->name);
++ of_node_put(np);
+ return ERR_PTR(-ENODEV);
+ }
++ of_node_put(np);
+
+ if (!try_module_get(THIS_MODULE)) {
+ dev_err(dev, "failed to get the device driver module\n");
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -1388,6 +1388,10 @@ static int airoha_hw_init(struct platfor
+@@ -1383,6 +1383,10 @@ static int airoha_hw_init(struct platfor
if (err)
return err;
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -593,8 +593,11 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -588,8 +588,11 @@ static int airoha_qdma_get_gdm_port(stru
sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
switch (sport) {
airoha_fe_crsn_qsel_init(eth);
-@@ -1630,7 +1632,8 @@ static int airoha_dev_open(struct net_de
+@@ -1625,7 +1627,8 @@ static int airoha_dev_open(struct net_de
if (err)
return err;
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -3100,7 +3100,6 @@ static void airoha_remove(struct platfor
+@@ -3095,7 +3095,6 @@ static void airoha_remove(struct platfor
}
static const char * const en7581_xsi_rsts_names[] = {
"hsi0-mac",
"hsi1-mac",
"hsi-mac",
-@@ -3132,7 +3131,6 @@ static int airoha_en7581_get_src_port_id
+@@ -3127,7 +3126,6 @@ static int airoha_en7581_get_src_port_id
}
static const char * const an7583_xsi_rsts_names[] = {
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
struct airoha_eth *eth = port->qdma->eth;
-@@ -1627,6 +1633,17 @@ static int airoha_dev_open(struct net_de
+@@ -1622,6 +1628,17 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
if (err)
-@@ -1680,6 +1697,11 @@ static int airoha_dev_stop(struct net_de
+@@ -1675,6 +1692,11 @@ static int airoha_dev_stop(struct net_de
}
}
return 0;
}
-@@ -2828,6 +2850,20 @@ static const struct ethtool_ops airoha_e
+@@ -2823,6 +2845,20 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
int i;
-@@ -2872,6 +2908,99 @@ bool airoha_is_valid_gdm_port(struct air
+@@ -2867,6 +2903,99 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
{
-@@ -2950,6 +3079,12 @@ static int airoha_alloc_gdm_port(struct
+@@ -2945,6 +3074,12 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
err = register_netdev(dev);
if (err)
goto free_metadata_dst;
-@@ -3065,6 +3200,10 @@ error_hw_cleanup:
+@@ -3060,6 +3195,10 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
}
}
free_netdev(eth->napi_dev);
-@@ -3092,6 +3231,10 @@ static void airoha_remove(struct platfor
+@@ -3087,6 +3226,10 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
--- a/drivers/net/ethernet/airoha/airoha_eth.c
+++ b/drivers/net/ethernet/airoha/airoha_eth.c
-@@ -604,6 +604,9 @@ static int airoha_qdma_get_gdm_port(stru
+@@ -599,6 +599,9 @@ static int airoha_qdma_get_gdm_port(stru
case 0x18:
port = 3; /* GDM4 */
break;
static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
{
-@@ -1636,6 +1638,7 @@ static int airoha_dev_open(struct net_de
+@@ -1631,6 +1633,7 @@ static int airoha_dev_open(struct net_de
struct airoha_gdm_port *port = netdev_priv(dev);
struct airoha_qdma *qdma = port->qdma;
if (airhoa_is_phy_external(port)) {
err = phylink_of_phy_connect(port->phylink, dev->dev.of_node, 0);
if (err) {
-@@ -1646,6 +1649,7 @@ static int airoha_dev_open(struct net_de
+@@ -1641,6 +1644,7 @@ static int airoha_dev_open(struct net_de
phylink_start(port->phylink);
}
netif_tx_start_all_queues(dev);
err = airoha_set_vip_for_gdm_port(port, true);
-@@ -1700,10 +1704,12 @@ static int airoha_dev_stop(struct net_de
+@@ -1695,10 +1699,12 @@ static int airoha_dev_stop(struct net_de
}
}
return 0;
}
-@@ -2853,6 +2859,7 @@ static const struct ethtool_ops airoha_e
+@@ -2848,6 +2854,7 @@ static const struct ethtool_ops airoha_e
.get_link = ethtool_op_get_link,
};
static struct phylink_pcs *airoha_phylink_mac_select_pcs(struct phylink_config *config,
phy_interface_t interface)
{
-@@ -2866,6 +2873,7 @@ static void airoha_mac_config(struct phy
+@@ -2861,6 +2868,7 @@ static void airoha_mac_config(struct phy
const struct phylink_link_state *state)
{
}
static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
{
-@@ -2911,6 +2919,7 @@ bool airoha_is_valid_gdm_port(struct air
+@@ -2906,6 +2914,7 @@ bool airoha_is_valid_gdm_port(struct air
return false;
}
static void airoha_mac_link_up(struct phylink_config *config, struct phy_device *phy,
unsigned int mode, phy_interface_t interface,
int speed, int duplex, bool tx_pause, bool rx_pause)
-@@ -3003,6 +3012,7 @@ static int airoha_setup_phylink(struct n
+@@ -2998,6 +3007,7 @@ static int airoha_setup_phylink(struct n
return 0;
}
static int airoha_alloc_gdm_port(struct airoha_eth *eth,
struct device_node *np, int index)
-@@ -3082,11 +3092,13 @@ static int airoha_alloc_gdm_port(struct
+@@ -3077,11 +3087,13 @@ static int airoha_alloc_gdm_port(struct
if (err)
return err;
err = register_netdev(dev);
if (err)
-@@ -3203,10 +3215,12 @@ error_hw_cleanup:
+@@ -3198,10 +3210,12 @@ error_hw_cleanup:
if (port && port->dev->reg_state == NETREG_REGISTERED) {
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
}
}
free_netdev(eth->napi_dev);
-@@ -3234,10 +3248,12 @@ static void airoha_remove(struct platfor
+@@ -3229,10 +3243,12 @@ static void airoha_remove(struct platfor
airoha_dev_stop(port->dev);
unregister_netdev(port->dev);
airoha_metadata_dst_free(port);
projects / thirdparty / openwrt.git / commitdiff
