Re: [PATCH net] dpaa2-switch: fix port cleanup on probe errors

[Paolo Abeni]

On 11/2/26 08:13, Jaeyeong Lee wrote:
> dpaa2_switch_probe() reuses i while probing ports, adding NAPI
> instances, registering netdevs, and unwinding failures. Consequently,
> the value reaching the port removal loop does not always represent the
> number of successfully probed ports.
>
> If IRQ setup fails, i is left equal to DPAA2_SWITCH_RX_NUM_FQS. A
> switch with one interface then causes the unwind path to access
> ports[1] out of bounds, while a switch with more than two interfaces
> leaks all ports after ports[1].
>
> If register_netdev() fails, the unregister loop consumes i down to -1.
> The following port removal loop is therefore skipped, leaking every
> port netdev and its MAC endpoint reference. The NAPI instances attached
> to port 0 also remain linked while their enclosing ethsw is freed.
>
> The issue was discovered by a static analysis tool and confirmed by
> manually tracing the probe error paths.
>
> Track successfully probed and registered ports independently. On
> post-NAPI failures, unregister only successfully registered netdevs,
> delete the NAPI instances, and then remove every successfully probed
> port.
>
> Fixes: 0b1b71370458 ("staging: dpaa2-switch: handle Rx path on control interface")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jaeyeong Lee <lee@xxxxxxxxxxx>
As per Linus guidance issues in error paths in NIC setup/teardown
do not qualifyfor net nor stable. Applying to net-next, with stable stripped.

/P