RE: [PATCH net v3] net: fec: Propagate PTP initialization errors

[Wei Fang]

> > [Severity: High]
> > Does this error return leave the devm-managed IRQ active while propagating
> an
> > error back to the probe function?
> >
> > If ptp_clock_register() fails, fec_ptp_init() returns an error which
> > propagates to fec_probe(), causing it to jump to failed_reset.
> >
> > The error path in fec_probe() manually frees ndev via free_netdev(ndev).
> >
> > However, the PPS interrupt was registered just prior using devm_request_irq(),
> > so it remains active until fec_probe() returns and devres tears it down.
> >
> > If the PPS interrupt fires between the manual free of ndev and the devres
> > cleanup, will fec_pps_interrupt() cast dev_id to ndev and attempt to
> > dereference the already-freed ndev structure, causing a use-after-free crash?
> 
> 
> This is a pre-existing issue:
> 
> Previously, I suggested using request_irq() and free_irq() manually,
> but that would add more code.
> Another option is to replace alloc_etherdev_mqs() with
> devm_alloc_etherdev_mqs(). With the LIFO cleanup order,
> devm_request_irq() will be cleaned up before free_netdev(res->ndev),
> which should resolve the issue.
> 
> Since this is a long-standing, pre-existing issue, I think it would be
> better to handle it in a separate patch.

This issue is currently being addressed in another thread:
https://lore.kernel.org/imx/20260904-fec-ptp-pps-event-uaf-v1-2-9af446be4a11@xxxxxxxx/