[PATCH net v3 2/2] net: ravb: serialize PTP clock teardown

From: Xuanqiang Luo <[email protected]>

ravb_get_ts_info() can run without RTNL while ravb_ptp_stop() unregisters
the PHC. The PTP interrupt handler can race with the same teardown, so both
paths may access the clock while it is being freed.

Protect the clock pointer with priv->lock, clear it before unregistering
the PHC, and unregister the detached clock outside the lock.

Fixes: a0d2f20650e8 ("Renesas Ethernet AVB PTP clock driver")
Cc: [email protected]
Signed-off-by: Xuanqiang Luo <[email protected]>
---
 drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++----
 drivers/net/ethernet/renesas/ravb_ptp.c  | 17 +++++++++++++----
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 3a9d9f8718216..c2220a54a2bf4 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1765,8 +1765,13 @@ static int ravb_set_ringparam(struct net_device *ndev,
 static int ravb_get_ts_info(struct net_device *ndev,
 			    struct kernel_ethtool_ts_info *info)
 {
-	struct ravb_private *priv = netdev_priv(ndev);
-	const struct ravb_hw_info *hw_info = priv->info;
+	const struct ravb_hw_info *hw_info;
+	struct ravb_private *priv;
+	struct ptp_clock *clock;
+	unsigned long flags;
+
+	priv = netdev_priv(ndev);
+	hw_info = priv->info;
 
 	if (hw_info->gptp || hw_info->ccc_gac) {
 		info->so_timestamping =
@@ -1779,8 +1784,11 @@ static int ravb_get_ts_info(struct net_device *ndev,
 			(1 << HWTSTAMP_FILTER_NONE) |
 			(1 << HWTSTAMP_FILTER_PTP_V2_L2_EVENT) |
 			(1 << HWTSTAMP_FILTER_ALL);
-		if (priv->ptp.clock)
-			info->phc_index = ptp_clock_index(priv->ptp.clock);
+		spin_lock_irqsave(&priv->lock, flags);
+		clock = priv->ptp.clock;
+		if (clock)
+			info->phc_index = ptp_clock_index(clock);
+		spin_unlock_irqrestore(&priv->lock, flags);
 	}
 
 	return 0;
diff --git a/drivers/net/ethernet/renesas/ravb_ptp.c b/drivers/net/ethernet/renesas/ravb_ptp.c
index eaf07cb8eadfa..530902a99d5ba 100644
--- a/drivers/net/ethernet/renesas/ravb_ptp.c
+++ b/drivers/net/ethernet/renesas/ravb_ptp.c
@@ -289,16 +289,17 @@ static const struct ptp_clock_info ravb_ptp_info = {
 void ravb_ptp_interrupt(struct net_device *ndev)
 {
 	struct ravb_private *priv = netdev_priv(ndev);
+	struct ptp_clock *clock = priv->ptp.clock;
 	u32 gis = ravb_read(ndev, GIS);
 
 	gis &= ravb_read(ndev, GIC);
-	if (gis & GIS_PTCF) {
+	if ((gis & GIS_PTCF) && clock) {
 		struct ptp_clock_event event;
 
 		event.type = PTP_CLOCK_EXTTS;
 		event.index = 0;
 		event.timestamp = ravb_read(ndev, GCPT);
-		ptp_clock_event(priv->ptp.clock, &event);
+		ptp_clock_event(clock, &event);
 	}
 	if (gis & GIS_PTMF) {
 		struct ravb_ptp_perout *perout = priv->ptp.perout;
@@ -334,16 +335,24 @@ void ravb_ptp_init(struct net_device *ndev, struct platform_device *pdev)
 		clock = NULL;
 	}
 
+	spin_lock_irqsave(&priv->lock, flags);
 	priv->ptp.clock = clock;
+	spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 void ravb_ptp_stop(struct net_device *ndev)
 {
 	struct ravb_private *priv = netdev_priv(ndev);
+	struct ptp_clock *clock;
+	unsigned long flags;
 
+	spin_lock_irqsave(&priv->lock, flags);
 	ravb_write(ndev, 0, GIC);
 	ravb_write(ndev, 0, GIS);
+	clock = priv->ptp.clock;
+	priv->ptp.clock = NULL;
+	spin_unlock_irqrestore(&priv->lock, flags);
 
-	if (priv->ptp.clock)
-		ptp_clock_unregister(priv->ptp.clock);
+	if (clock)
+		ptp_clock_unregister(clock);
 }
-- 
2.43.0