net: dsa: microchip: Fix symetry in ksz_ptp_msg_irq_{setup/free}()

The IRQ numbers created through irq_create_mapping() are only assigned
to ptpmsg_irq[n].num at the end of the IRQ setup. So if an error occurs
between their creation and their assignment (for instance during the
request_threaded_irq() step), we enter the error path and fail to
release the newly created virtual IRQs because they aren't yet assigned
to ptpmsg_irq[n].num.

Move the mapping creation to ksz_ptp_msg_irq_setup() to ensure symetry
with what's released by ksz_ptp_msg_irq_free().
In the error path, move the irq_dispose_mapping to the out_ptp_msg label
so it will be called only on created IRQs.

Cc: stable@vger.kernel.org
Fixes: cc13ab18b201 ("net: dsa: microchip: ptp: enable interrupt for timestamping")
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com>
Link: https://patch.msgid.link/20251120-ksz-fix-v6-5-891f80ae7f8f@bootlin.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/drivers/net/dsa/microchip/ksz_ptp.c b/drivers/net/dsa/microchip/ksz_ptp.c
index c8bfbe5e2157323ecf29149d1907b77e689aa221..997e4a76d0a68448b0ebc76169150687bbc79673 100644 (file)
--- a/drivers/net/dsa/microchip/ksz_ptp.c
+++ b/drivers/net/dsa/microchip/ksz_ptp.c
@@ -1093,19 +1093,19 @@ static int ksz_ptp_msg_irq_setup(struct ksz_port *port, u8 n)
        static const char * const name[] = {"pdresp-msg", "xdreq-msg",
                                            "sync-msg"};
        const struct ksz_dev_ops *ops = port->ksz_dev->dev_ops;
+       struct ksz_irq *ptpirq = &port->ptpirq;
        struct ksz_ptp_irq *ptpmsg_irq;
 
        ptpmsg_irq = &port->ptpmsg_irq[n];
+       ptpmsg_irq->num = irq_create_mapping(ptpirq->domain, n);
+       if (!ptpmsg_irq->num)
+               return -EINVAL;
 
        ptpmsg_irq->port = port;
        ptpmsg_irq->ts_reg = ops->get_port_addr(port->num, ts_reg[n]);
 
        strscpy(ptpmsg_irq->name, name[n]);
 
-       ptpmsg_irq->num = irq_find_mapping(port->ptpirq.domain, n);
-       if (ptpmsg_irq->num < 0)
-               return ptpmsg_irq->num;
-
        return request_threaded_irq(ptpmsg_irq->num, NULL,
                                    ksz_ptp_msg_thread_fn, IRQF_ONESHOT,
                                    ptpmsg_irq->name, ptpmsg_irq);
@@ -1135,9 +1135,6 @@ int ksz_ptp_irq_setup(struct dsa_switch *ds, u8 p)
        if (!ptpirq->domain)
                return -ENOMEM;
 
-       for (irq = 0; irq < ptpirq->nirqs; irq++)
-               irq_create_mapping(ptpirq->domain, irq);
-
        ptpirq->irq_num = irq_find_mapping(port->pirq.domain, PORT_SRC_PTP_INT);
        if (!ptpirq->irq_num) {
                ret = -EINVAL;
@@ -1159,12 +1156,11 @@ int ksz_ptp_irq_setup(struct dsa_switch *ds, u8 p)
 
 out_ptp_msg:
        free_irq(ptpirq->irq_num, ptpirq);
-       while (irq--)
+       while (irq--) {
                free_irq(port->ptpmsg_irq[irq].num, &port->ptpmsg_irq[irq]);
-out:
-       for (irq = 0; irq < ptpirq->nirqs; irq++)
                irq_dispose_mapping(port->ptpmsg_irq[irq].num);
-
+       }
+out:
        irq_domain_remove(ptpirq->domain);
 
        return ret;