Skip to contentSkip to conversation

net: sparx5: skip ptp deinit if init was skipped

PATCH Applied Quentin Freimanis 3 participants 3 messages Sep 28 – Sep 30

Subsystems (3)
lore
Share & tools
lore
#0 lore raw

PATCH 1/1 net: sparx5: skip ptp deinit if init was skipped

sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000008
    Call trace:
    skb_queue_purge_reason+0x68/0x120 (P)
    sparx5_ptp_deinit+0x64/0xc0
    mchp_sparx5_remove+0x38/0x70
    platform_remove+0x20/0x30
    device_remove+0x4c/0x80

Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks.

Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

Fixes 0933bd04047c ("net: sparx5: Add support for ptp clocks")
---
 drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/net/ethernet/microchip/sparx5/sparx5_ptp.c +3 -0
index a16ec8136d6d..5953e04ef14e 100644
@@ -673,6 +673,9 @@ void sparx5_ptp_deinit(struct sparx5 *sparx5)
 	struct sparx5_port *port;
 	int i;
 
+	if (!sparx5->ptp)
+		return;
+
 	if (sparx5->ptp_irq >= 0) {
 		disable_irq(sparx5->ptp_irq);
 		sparx5->ptp_irq = -ENXIO;
Signature · 1 line
2.55.0
maintainer Reviewed-by Tested-by on v1 1/1
#1 lore raw

Hi Quentin,

Quoted 14 lines

sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000008
    Call trace:
    skb_queue_purge_reason+0x68/0x120 (P)
    sparx5_ptp_deinit+0x64/0xc0
    mchp_sparx5_remove+0x38/0x70
    platform_remove+0x20/0x30
    device_remove+0x4c/0x80
Quoted 7 lines

Before per-port tx_skbs were added, a NULL dereference would have happened when calling ptp_clock_unregister() on the never-registered PTP clocks.

Fix by returning early in sparx5_ptp_deinit() if PTP is not used.

Fixes 0933bd04047c ("net: sparx5: Add support for ptp clocks")

Thanks!

/Daniel

#2 lore raw
In reply to Quentin Freimanis
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 14 lines · On Sun, 27 Sep 2026 21:45:42 -0700 you wrote:

sparx5_ptp_init() returns early on the base lan969x variants because they do not have the SPX5_FEATURE_PTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the driver then causes a NULL pointer dereference when cleaning up uninitialized tx_skbs queues:

    Unable to handle kernel NULL pointer dereference at virtual address
    0000000000000008
    Call trace:
    skb_queue_purge_reason+0x68/0x120 (P)
    sparx5_ptp_deinit+0x64/0xc0
    mchp_sparx5_remove+0x38/0x70
    platform_remove+0x20/0x30
    device_remove+0x4c/0x80
Quoted 1 line

[...]

Here is the summary with links:
- [net] net: sparx5: skip ptp deinit if init was skipped

    https://git.kernel.org/netdev/net/c/0d2c49915bc3

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html