@@ -626,6 +626,7 @@ static enum dsa_tag_protocol dsa_get_tag_protocol(struct dsa_port *dp,
* happens the switch driver may want to know if its tagging protocol
* is going to work in such a configuration.
*/
+ dev_hold(master);
if (dsa_slave_dev_check(master)) {
mdp = dsa_slave_to_port(master);
mds = mdp->ds;
@@ -633,6 +634,7 @@ static enum dsa_tag_protocol dsa_get_tag_protocol(struct dsa_port *dp,
tag_protocol = mds->ops->get_tag_protocol(mds, mdp_upstream,
DSA_TAG_PROTO_NONE);
}
+ dev_put(master);
/* If the master device is not itself a DSA slave in a disjoint DSA
* tree, then return immediately.
@@ -657,6 +659,7 @@ static int dsa_port_parse_cpu(struct dsa_port *dp, struct net_device *master)
return PTR_ERR(tag_ops);
}
+ dev_hold(master);
dp->master = master;
dp->type = DSA_PORT_TYPE_CPU;
dp->filter = tag_ops->filter;
@@ -858,6 +861,8 @@ static void dsa_switch_release_ports(struct dsa_switch *ds)
if (dp->ds != ds)
continue;
list_del(&dp->list);
+ if (dsa_port_is_cpu(dp))
+ dev_put(dp->master);
kfree(dp);
}
}
If we are probed through platform_data we would be intentionally dropping the reference count on master after dev_to_net_device() incremented it. If we are probed through Device Tree, of_find_net_device() does not do a dev_hold() at all. Ensure that the DSA master device is properly reference counted by holding it as soon as the CPU port is successfully initialized and later released during dsa_switch_release_ports(). dsa_get_tag_protocol() does a short de-reference, so we hold and release the master at that time, too. Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> --- net/dsa/dsa2.c | 5 +++++ 1 file changed, 5 insertions(+)