[openwrt/openwrt] realtek: dsa: rtl839x: fix uninitialized global access

LEDE Commits lede-commits at lists.infradead.org
Mon Jan 26 00:58:24 PST 2026


robimarko pushed a commit to openwrt/openwrt.git, branch main:
https://git.openwrt.org/ac9646394482ba2e464ccf75e74c936485028305

commit ac9646394482ba2e464ccf75e74c936485028305
Author: Markus Stockhausen <markus.stockhausen at gmx.de>
AuthorDate: Sun Jan 25 19:07:32 2026 +0100

    realtek: dsa: rtl839x: fix uninitialized global access
    
    Setup for DSA QOS on RTL839x accesses unitialized memory. For some
    reason the handover of the priv structure was realized via global
    intermediate variable switch_priv. During refactoring for adbb9a6
    ("realtek: dsa: rtl83xx: fix init section mismatch") this was not
    noticed. Since then RTL839x devices crash during startup.
    
    Fix this by using standard handover via function parameters.
    
    Fixes: adbb9a6 ("realtek: dsa: rtl83xx: fix init section mismatch")
    Signed-off-by: Markus Stockhausen <markus.stockhausen at gmx.de>
    Link: https://github.com/openwrt/openwrt/pull/21703
    Signed-off-by: Robert Marko <robimarko at gmail.com>
---
 target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/qos.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/qos.c b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/qos.c
index ff515bea10..e30ee51b70 100644
--- a/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/qos.c
+++ b/target/linux/realtek/files-6.12/drivers/net/dsa/rtl83xx/qos.c
@@ -6,8 +6,6 @@
 
 #include "rtl83xx.h"
 
-static struct rtl838x_switch_priv *switch_priv;
-
 enum scheduler_type {
 	WEIGHTED_FAIR_QUEUE = 0,
 	WEIGHTED_ROUND_ROBIN,
@@ -445,7 +443,7 @@ static void rtl839x_set_scheduling_queue_weights(struct rtl838x_switch_priv *pri
 	mutex_unlock(&priv->reg_mutex);
 }
 
-static void rtl838x_config_qos(void)
+static void rtl838x_config_qos(struct rtl838x_switch_priv *priv)
 {
 	u32 v;
 
@@ -490,10 +488,9 @@ static void rtl838x_config_qos(void)
 	sw_w32_mask(0, 7, RTL838X_QM_PKT2CPU_INTPRI_1);
 }
 
-static void rtl839x_config_qos(void)
+static void rtl839x_config_qos(struct rtl838x_switch_priv *priv)
 {
 	u32 v;
-	struct rtl838x_switch_priv *priv = switch_priv;
 
 	pr_info("Setting up RTL839X QoS\n");
 	pr_info("RTL839X_PRI_SEL_TBL_CTRL(i): %08x\n", sw_r32(RTL839X_PRI_SEL_TBL_CTRL(0)));
@@ -549,12 +546,12 @@ static void rtl839x_config_qos(void)
 
 void rtldsa_838x_qos_init(struct rtl838x_switch_priv *priv)
 {
-	rtl838x_config_qos();
+	rtl838x_config_qos(priv);
 	rtl838x_rate_control_init(priv);
 }
 
 void rtldsa_839x_qos_init(struct rtl838x_switch_priv *priv)
 {
-	rtl839x_config_qos();
+	rtl839x_config_qos(priv);
 	rtl839x_rate_control_init(priv);
 }




More information about the lede-commits mailing list