[PATCH v2 1/2] net: eth-uclass: Fix eth_halt

[PATCH v2 1/2] net: eth-uclass: Fix eth_halt

[qianfanguijin]

From: qianfan Zhao <qianfanguijin@163.com>

eth_device_priv maybe unaccessable after @stop handler due to eth device
is removed in @stop. Setting private data before @stop handler.

This also fix data abort bug when run dhcp or tftp command via usbnet.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
---
 net/eth-uclass.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/eth-uclass.c b/net/eth-uclass.c
index 58c308f332..c6eb1bc8f8 100644
--- a/net/eth-uclass.c
+++ b/net/eth-uclass.c
@@ -338,9 +338,14 @@ void eth_halt(void)
 	if (!priv || !priv->running)
 		return;
 
-	eth_get_ops(current)->stop(current);
-	priv->state = ETH_STATE_PASSIVE;
+	/* Make sure setting private data before @stop handler, it may remove
+	 * ethernet device and will cause @priv unaccessable.
+	 * eg:
+	 * usb_eth_stop -> usb_gadget_release -> device_remove
+	 */
 	priv->running = false;
+
+	eth_get_ops(current)->stop(current);
 }
 
 int eth_is_active(struct udevice *dev)
-- 
2.17.1

[PATCH v2 2/2] net: eth-uclass: Fix data abort when tftp get nonexistent file via usb

[qianfanguijin]

From: qianfan Zhao <qianfanguijin@163.com>

tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth
device if it is an usb network. usbeth's private data will be unaccessable
when usb_eth_free_pkt, touch it will trigger data abort.

Next is the console messages:

=> tftp xxx
...
Loading: *
TFTP error: 'open failed: No such file or directory' (1)
Not retrying...
data abort
pc : [<9feb6ba2>]          lr : [<9feb6b9f>]

Fix it.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
---
 net/eth-uclass.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/net/eth-uclass.c b/net/eth-uclass.c
index c6eb1bc8f8..27baf52c26 100644
--- a/net/eth-uclass.c
+++ b/net/eth-uclass.c
@@ -405,6 +405,13 @@ int eth_rx(void)
 		flags = 0;
 		if (ret > 0)
 			net_process_received_packet(packet, ret);
+
+		/* ethernet maybe halted when packet_handler, check again */
+		if (!eth_is_active(current)) {
+			ret = 0;
+			break;
+		}
+
 		if (ret >= 0 && eth_get_ops(current)->free_pkt)
 			eth_get_ops(current)->free_pkt(current, packet, ret);
 		if (ret <= 0)
-- 
2.17.1

Re: [PATCH v2 2/2] net: eth-uclass: Fix data abort when tftp get nonexistent file via usb

[Ramon Fried]

On Mon, Mar 28, 2022 at 12:58 PM <qianfanguijin@163.com> wrote:
>
> From: qianfan Zhao <qianfanguijin@163.com>
>
> tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth
> device if it is an usb network. usbeth's private data will be unaccessable
> when usb_eth_free_pkt, touch it will trigger data abort.
>
> Next is the console messages:
>
> => tftp xxx
> ...
> Loading: *
> TFTP error: 'open failed: No such file or directory' (1)
> Not retrying...
> data abort
> pc : [<9feb6ba2>]          lr : [<9feb6b9f>]
>
> Fix it.
>
> Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
> ---
>  net/eth-uclass.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/net/eth-uclass.c b/net/eth-uclass.c
> index c6eb1bc8f8..27baf52c26 100644
> --- a/net/eth-uclass.c
> +++ b/net/eth-uclass.c
> @@ -405,6 +405,13 @@ int eth_rx(void)
>                 flags = 0;
>                 if (ret > 0)
>                         net_process_received_packet(packet, ret);
> +
> +               /* ethernet maybe halted when packet_handler, check again */
> +               if (!eth_is_active(current)) {
> +                       ret = 0;
> +                       break;
> +               }
> +
>                 if (ret >= 0 && eth_get_ops(current)->free_pkt)
>                         eth_get_ops(current)->free_pkt(current, packet, ret);
>                 if (ret <= 0)
> --
> 2.17.1
>
Reviewed-by: Ramon Fried <rfried.dev@gmail.com>

[PATCH v2 1/2] net: eth-uclass: Fix eth_halt

[qianfanguijin]

From: qianfan Zhao <qianfanguijin@163.com>

eth_device_priv maybe unaccessable after @stop handler due to eth device
is removed in @stop, touch it will trigger data abort.

Fix data abort bug when run dhcp or tftp command via usbnet.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
---
 net/eth-uclass.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/eth-uclass.c b/net/eth-uclass.c
index 0da0e85be0..2b88b6c145 100644
--- a/net/eth-uclass.c
+++ b/net/eth-uclass.c
@@ -339,8 +339,15 @@ void eth_halt(void)
 		return;
 
 	eth_get_ops(current)->stop(current);
-	priv->state = ETH_STATE_PASSIVE;
-	priv->running = false;
+
+	/* ethernet device maybe removed when @stop handler, that will cause
+	 * @priv is freed. get private data again to avoid it
+	 */
+	priv = dev_get_uclass_priv(current);
+	if (priv) {
+		priv->state = ETH_STATE_PASSIVE;
+		priv->running = false;
+	}
 }
 
 int eth_is_active(struct udevice *dev)
-- 
2.17.1