Re: [PATCH net] dpaa2-switch: fix port cleanup on probe errors

[Ioana Ciornei]

On Mon, Nov 02, 2026 at 07:13:18AM +0000, Jaeyeong Lee wrote:
> dpaa2_switch_probe() reuses i while probing ports, adding NAPI
> instances, registering netdevs, and unwinding failures. Consequently,
> the value reaching the port removal loop does not always represent the
> number of successfully probed ports.
> 
> If IRQ setup fails, i is left equal to DPAA2_SWITCH_RX_NUM_FQS. A
> switch with one interface then causes the unwind path to access
> ports[1] out of bounds, while a switch with more than two interfaces
> leaks all ports after ports[1].
> 
> If register_netdev() fails, the unregister loop consumes i down to -1.
> The following port removal loop is therefore skipped, leaking every
> port netdev and its MAC endpoint reference. The NAPI instances attached
> to port 0 also remain linked while their enclosing ethsw is freed.
> 
> The issue was discovered by a static analysis tool and confirmed by
> manually tracing the probe error paths.
> 
> Track successfully probed and registered ports independently. On
> post-NAPI failures, unregister only successfully registered netdevs,
> delete the NAPI instances, and then remove every successfully probed
> port.
> 
> Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jaeyeong Lee <lee@xxxxxxxxxxx>

Reviewed-by: Ioana Ciornei <ioana.ciornei@xxxxxxx>