Re: [PATCH net-next 2/7] ptp: netc: remove unnecessary pcie_flr() call in probe

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but the driver fails to initialize NETC_TMR_TEMASK to 0 during probe, which can leave interrupts enabled from a previous kernel. Combined with the ISR masking logic, this causes unrecoverable interrupt wedging or storms.
- [High] This problem wasn't introduced by this patch, but teardown ordering allows late IRQs to access a freed ptp_clock pointer, resulting in a use-after-free vulnerability.
--

--- Patch [2]: [PATCH net-next 2/7] ptp: netc: remove unnecessary pcie_flr() call in probe ---
commit fe3a9be0d4fb11cfd834174e67a7435d22d701a7
Author: Wei Fang <[email protected]>
Date:   Tue Jul 28 10:45:43 2026 +0000

ptp: netc: remove unnecessary pcie_flr() call in probe

This commit removes an unnecessary function level reset call from the NETC
timer probe function. According to the reference manual, this reset is not
applicable to the timer as a supporting function.

> diff --git a/drivers/ptp/ptp_netc.c b/drivers/ptp/ptp_netc.c
> index 683abcdff9ad6..072809ea7922c 100644
> --- a/drivers/ptp/ptp_netc.c
> +++ b/drivers/ptp/ptp_netc.c
> @@ -773,7 +773,6 @@ static int netc_timer_pci_probe(struct pci_dev *pdev)
>  	if (!priv)
>  		return -ENOMEM;
>  
> -	pcie_flr(pdev);
>  	err = pci_enable_device_mem(pdev);
>  	if (err)
>  		return dev_err_probe(dev, err, "Failed to enable device\n");

[Severity: High]
This isn't a bug introduced by this patch, but the driver fails to initialize
NETC_TMR_TEMASK to 0 during probe, which can leave interrupts enabled from a
previous kernel. Combined with the ISR masking logic, could this cause
unrecoverable interrupt wedging or storms?

For example, in a kexec scenario, if the previous kernel left hardware
interrupts unmasked in NETC_TMR_TEMASK, the new kernel calls request_irq()
before clearing the hardware mask:

drivers/ptp/ptp_netc.c:netc_timer_probe() {
    ...
	err = netc_timer_init_msix_irq(priv);
	if (err)
		goto timer_pci_remove;

	netc_timer_init(priv);
    ...
}

The ISR reads NETC_TMR_TEVENT, masks it with the software shadow
priv->tmr_emask (which is initialized to 0), and writes 0 back to the
write-1-to-clear register:

drivers/ptp/ptp_netc.c:netc_timer_isr() {
    ...
	tmr_event = netc_timer_rd(priv, NETC_TMR_TEVENT);
	tmr_event &= priv->tmr_emask;
	/* Clear interrupts status */
	netc_timer_wr(priv, NETC_TMR_TEVENT, tmr_event);
    ...
}

Because priv->tmr_emask is 0, tmr_event becomes 0, and writing 0 fails to
clear the hardware interrupt state.

[Severity: High]
This is a pre-existing issue, but does the teardown ordering in
netc_timer_remove() allow late IRQs to access a freed ptp_clock pointer,
resulting in a use-after-free?

In netc_timer_remove(), ptp_clock_unregister() is called before the MSI-X
interrupt is freed or synchronized via netc_timer_free_msix_irq():

drivers/ptp/ptp_netc.c:netc_timer_remove() {
    ...
	ptp_clock_unregister(priv->clock);
	netc_timer_free_msix_irq(priv);
    ...
}

If an interrupt is in-flight or arrives after ptp_clock_unregister() frees the
clock instance, the ISR dereferences the dangling priv->clock pointer:

drivers/ptp/ptp_netc.c:netc_timer_isr() {
    ...
	if (tmr_event & TMR_TEVENT_PPEN_ALL) {
		event.type = PTP_CLOCK_PPS;
		ptp_clock_event(priv->clock, &event);
	}
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=2