[PATCH] net: gianfar: fix use-after-free in gfar_enet_open on startup_gfar failure

[Rosen Penev]

If startup_gfar() fails in gfar_enet_open(), the PHY remains connected
and IRQs remain requested. Since ndo_open returned an error, IFF_UP is
not set and ndo_stop (gfar_close) will not be called on unregister,
leaving the IRQ handlers registered against freed net_device memory
when the driver is removed.

Add proper error unwinding: phy_disconnect() and gfar_free_irq() before
returning the error.

Fixes: 80ec396cb6b5 ("gianfar: Don't free/request irqs on device reset")

Assisted-by: Opencode:Big-Pickle
Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
---
 drivers/net/ethernet/freescale/gianfar.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 89215e1ddc2d..4b3a5eaadfb5 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2878,8 +2878,11 @@ static int gfar_enet_open(struct net_device *dev)
 		return err;
 
 	err = startup_gfar(dev);
-	if (err)
+	if (err) {
+		phy_disconnect(dev->phydev);
+		gfar_free_irq(priv);
 		return err;
+	}
 
 	return err;
 }
-- 
2.55.0