[PATCH 1/1] net: fec: fix oops after transmit queue timeout

[PATCH 1/1] net: fec: fix oops after transmit queue timeout

[George Joseph]

When a transmit queue timeout happens, dev_watchdog calls fec_timeout
which in turns schedules fec_enet_timeout_work.  fec_enet_timeout_work
uses container_of to get the private data structure (fep) then tries to
use fep->netdev.  Unfortunately, nobody ever set fep->netdev so the result
is a NULL pointer oops.

With fep->netdev set right after fep is allocated in fep_probe, the
drivers recovers nicely after the tx queue timeout.

Signed-off-by: George Joseph <george.joseph@fairview5.com>
Tested-by: George Joseph <george.joseph@fairview5.com>
---
 drivers/net/ethernet/freescale/fec_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 3dca494..f6392ad 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -3161,6 +3161,7 @@ fec_probe(struct platform_device *pdev)
 	/* setup board info structure */
 	fep = netdev_priv(ndev);
 
+	fep->netdev = ndev;
 	fep->num_rx_queues = num_rx_qs;
 	fep->num_tx_queues = num_tx_qs;
 
-- 
2.1.0

Re: [PATCH 1/1] net: fec: fix oops after transmit queue timeout

[Fabio Estevam]

On Wed, Mar 11, 2015 at 2:00 PM, George Joseph
<george.joseph@fairview5.com> wrote:
> When a transmit queue timeout happens, dev_watchdog calls fec_timeout
> which in turns schedules fec_enet_timeout_work.  fec_enet_timeout_work
> uses container_of to get the private data structure (fep) then tries to
> use fep->netdev.  Unfortunately, nobody ever set fep->netdev so the result
> is a NULL pointer oops.
>
> With fep->netdev set right after fep is allocated in fep_probe, the
> drivers recovers nicely after the tx queue timeout.
>
> Signed-off-by: George Joseph <george.joseph@fairview5.com>
> Tested-by: George Joseph <george.joseph@fairview5.com>

Thanks for the patch, but this has already been fixed by:

commit 0c8185944a125621a1766615585238a3563ccac3
Author: Hubert Feurstein <h.feurstein@gmail.com>
Date:   Wed Jan 7 14:48:17 2015 +0100

    net: fec: fix NULL pointer dereference in fec_enet_timeout_work

    This patch initialises the fep->netdev pointer. This pointer was not
    initialised at all, but is used in fec_enet_timeout_work and in some
    error paths.

    Signed-off-by: Hubert Feurstein <h.feurstein@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>