Re: [PATCH v2 net 0/4] net: ti: icssg: Fix device_node handling in prueth_probe()

[Xiangwu Lai]

Hi,

Please find below the additional information requested for this
series. The same information was provided for the v1 postings of
patches 1 and 2 here:

https://lore.kernel.org/netdev/20261109093000.54321-laixiangwu@xxxxxxxxxxxxxxxxxxxx/
https://lore.kernel.org/netdev/20261109093500.54322-laixiangwu@xxxxxxxxxxxxxxxxxxxx/

How the issues were discovered: manual code inspection of the error
paths in prueth_probe() while auditing both ICSSG drivers for
probe-time resource leaks. The port scan issues addressed by
patches 3 and 4 were found in the same audit; the use of the
uninitialized reg value was also raised during the review of v1.

Whether the issues were actually triggered: no, they are purely
theoretical, all of them require a malformed device tree:

- Patches 1 and 2: the leak triggers only when the "ti,mii-g-rt" or
  "ti,mii-rt" syscon regmap lookup fails, which does not happen on
  a valid DT. probe() then fails with -ENODEV and the references
  taken on eth0_node/eth1_node are leaked silently; there is no
  stack trace or error message pointing at the leak itself.

- Patches 3 and 4: the uninitialized reg value is only used when a
  port node has no reg property, and a reference is only leaked for
  port nodes with a reg value outside 0/1 or with a duplicate reg
  value. On a valid DT (one port with reg 0 and one with reg 1) the
  loop behaves as before, with identical reference accounting for
  the accepted ports.

Hardware the change was tested on: none, the series was not tested
on real hardware. Patches 1 and 2 only re-route two error branches
to the existing put_cores label, which is already exercised by the
other failure paths in the same function (e.g. prueth_get_cores()
failures). Patches 3 and 4 move of_node_get() from an unconditional
call on every port child to the assignment points, so for ports
that are accepted the reference accounting is unchanged, and the
new error path only releases references it has just taken.

Best regards,
Xiangwu Lai