From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the following NULL pointer dereference is observed on a board with KSZ8061:
# udhcpc -i eth0 udhcpc: started, v1.35.0 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = f73cef4e [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 Hardware name: Freescale i.MX6 SoloX (Device Tree) PC is at kszphy_config_reset+0x10/0x114 LR is at kszphy_resume+0x24/0x64 ...
The KSZ8061 phy_driver structure does not have the .probe/..driver_data fields, which means that priv is not allocated.
This causes the NULL pointer dereference inside kszphy_config_reset().
Fix the problem by using the generic suspend/resume functions as before.
Another alternative would be to provide the .probe and .driver_data information into the structure, but to be on the safe side, let's just restore Ethernet functionality by using the generic suspend/resume.
Cc: stable@vger.kernel.org Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") Signed-off-by: Fabio Estevam festevam@denx.de --- Changes since v1: - Explained why enphy_suspend/resume solution is preferred (Andrew).
drivers/net/phy/micrel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c index 685a0ab5453c..11cd073630e5 100644 --- a/drivers/net/phy/micrel.c +++ b/drivers/net/phy/micrel.c @@ -3021,8 +3021,8 @@ static struct phy_driver ksphy_driver[] = { .config_init = ksz8061_config_init, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt, - .suspend = kszphy_suspend, - .resume = kszphy_resume, + .suspend = genphy_suspend, + .resume = genphy_resume, }, { .phy_id = PHY_ID_KSZ9021, .phy_id_mask = 0x000ffffe,
From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/ resume hooks are used.
These functions require the probe function to be called so that priv can be allocated.
Otherwise, a NULL pointer dereference happens inside kszphy_config_reset().
Cc: stable@vger.kernel.org Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") Reported-by: Andrew Lunn andrew@lunn.ch Signed-off-by: Fabio Estevam festevam@denx.de --- Changes since v1: - Newly introduced. This was noticed by Andrew.
drivers/net/phy/micrel.c | 1 + 1 file changed, 1 insertion(+)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c index 11cd073630e5..a06661c07ca8 100644 --- a/drivers/net/phy/micrel.c +++ b/drivers/net/phy/micrel.c @@ -2896,6 +2896,7 @@ static struct phy_driver ksphy_driver[] = { .name = "Micrel KS8737", /* PHY_BASIC_FEATURES */ .driver_data = &ks8737_type, + .probe = kszphy_probe, .config_init = kszphy_config_init, .config_intr = kszphy_config_intr, .handle_interrupt = kszphy_handle_interrupt,
On Wed, May 04, 2022 at 11:31:04AM -0300, Fabio Estevam wrote:
From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/ resume hooks are used.
These functions require the probe function to be called so that priv can be allocated.
Otherwise, a NULL pointer dereference happens inside kszphy_config_reset().
Cc: stable@vger.kernel.org Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") Reported-by: Andrew Lunn andrew@lunn.ch Signed-off-by: Fabio Estevam festevam@denx.de
Reviewed-by: Andrew Lunn andrew@lunn.ch
Andrew
Hi Andrew,
On Wed, May 4, 2022 at 11:31 AM Fabio Estevam festevam@gmail.com wrote:
From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the following NULL pointer dereference is observed on a board with KSZ8061:
# udhcpc -i eth0 udhcpc: started, v1.35.0 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = f73cef4e [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 Hardware name: Freescale i.MX6 SoloX (Device Tree) PC is at kszphy_config_reset+0x10/0x114 LR is at kszphy_resume+0x24/0x64 ...
The KSZ8061 phy_driver structure does not have the .probe/..driver_data fields, which means that priv is not allocated.
This causes the NULL pointer dereference inside kszphy_config_reset().
Fix the problem by using the generic suspend/resume functions as before.
Another alternative would be to provide the .probe and .driver_data information into the structure, but to be on the safe side, let's just restore Ethernet functionality by using the generic suspend/resume.
Cc: stable@vger.kernel.org Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") Signed-off-by: Fabio Estevam festevam@denx.de
Changes since v1:
- Explained why enphy_suspend/resume solution is preferred (Andrew).
If this series gets applied, I plan to submit two patches targeting net-next to:
1. Allow .probe to be called without .data_driver being passed 2. Convert KSZ8061 to use .probe and kszphy_suspend/resume
If this series gets applied, I plan to submit two patches targeting net-next to:
- Allow .probe to be called without .data_driver being passed
- Convert KSZ8061 to use .probe and kszphy_suspend/resume
Great.
Please wait at least a week so that net gets merged into net-next, so there are no merge conflicts.
Thanks Andrew
On Wed, May 04, 2022 at 11:31:03AM -0300, Fabio Estevam wrote:
From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the following NULL pointer dereference is observed on a board with KSZ8061:
# udhcpc -i eth0 udhcpc: started, v1.35.0 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = f73cef4e [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 Hardware name: Freescale i.MX6 SoloX (Device Tree) PC is at kszphy_config_reset+0x10/0x114 LR is at kszphy_resume+0x24/0x64 ...
The KSZ8061 phy_driver structure does not have the .probe/..driver_data fields, which means that priv is not allocated.
This causes the NULL pointer dereference inside kszphy_config_reset().
Fix the problem by using the generic suspend/resume functions as before.
Another alternative would be to provide the .probe and .driver_data information into the structure, but to be on the safe side, let's just restore Ethernet functionality by using the generic suspend/resume.
Cc: stable@vger.kernel.org Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") Signed-off-by: Fabio Estevam festevam@denx.de
Reviewed-by: Andrew Lunn andrew@lunn.ch
Andrew
Hello:
This series was applied to netdev/net.git (master) by Jakub Kicinski kuba@kernel.org:
On Wed, 4 May 2022 11:31:03 -0300 you wrote:
From: Fabio Estevam festevam@denx.de
Since commit f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices") the following NULL pointer dereference is observed on a board with KSZ8061:
# udhcpc -i eth0 udhcpc: started, v1.35.0 8<--- cut here --- Unable to handle kernel NULL pointer dereference at virtual address 00000008 pgd = f73cef4e [00000008] *pgd=00000000 Internal error: Oops: 5 [#1] SMP ARM Modules linked in: CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94 Hardware name: Freescale i.MX6 SoloX (Device Tree) PC is at kszphy_config_reset+0x10/0x114 LR is at kszphy_resume+0x24/0x64 ...
[...]
Here is the summary with links: - [net,v2,1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 https://git.kernel.org/netdev/net/c/e333eed63a09 - [net,v2,2/2] net: phy: micrel: Pass .probe for KS8737 https://git.kernel.org/netdev/net/c/15f03ffe4bb9
You are awesome, thank you!
linux-stable-mirror@lists.linaro.org
-
Andrew Lunn -
Fabio Estevam -
patchwork-bot+netdevbpf＠kernel.org