From: Russell King - ARM Linux <linux@armlinux.org.uk>
To: Florian Fainelli <f.fainelli@gmail.com>
Cc: netdev@vger.kernel.org, Andrew Lunn <andrew@lunn.ch>,
"David S. Miller" <davem@davemloft.net>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH net] net: phy: sfp: Prevent NULL deference of socket_ops
Date: Sat, 15 Sep 2018 08:32:28 +0100 [thread overview]
Message-ID: <20180915073228.GE30658@n2100.armlinux.org.uk> (raw)
In-Reply-To: <20180914230132.23228-1-f.fainelli@gmail.com>
On Fri, Sep 14, 2018 at 04:01:31PM -0700, Florian Fainelli wrote:
> In case we have specified a SFP and an I2C phandle in the Device Tree,
> but we somehow failed to look up the I2C adapter (e.g: the driver is not
> enabled), we will leave dangling socket_ops, and the sfp_bus will still
> have been registered. We can then observe NULL pointer dereferences
> while doing ethtool -m:
>
> [ 20.218613] Unable to handle kernel NULL pointer dereference at virtual address 00000008
> [ 20.226977] pgd = (ptrval)
> [ 20.229785] [00000008] *pgd=7c400831, *pte=00000000, *ppte=00000000
> [ 20.236274] Internal error: Oops: 17 [#1] SMP ARM
> [ 20.241122] Modules linked in:
> [ 20.244278] CPU: 0 PID: 1480 Comm: ethtool Not tainted 4.19.0-rc3 #138
> [ 20.251013] Hardware name: Broadcom Northstar Plus SoC
> [ 20.256316] PC is at sfp_get_module_info+0x8/0x10
> [ 20.261172] LR is at dev_ethtool+0x218c/0x2afc
>
> Specifically guard against that.
The other alternative to this would be to only set ndev->sfp_bus when
the bus moves to registered state, which would probably be a saner
alternative than to add an additional layer of tests. IOW:
drivers/net/phy/sfp-bus.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
index 48ca980f5c96..c4c2b5269216 100644
--- a/drivers/net/phy/sfp-bus.c
+++ b/drivers/net/phy/sfp-bus.c
@@ -362,6 +362,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
}
if (bus->started)
bus->socket_ops->start(bus->sfp);
+ bus->netdev->sfp_bus = bus;
bus->registered = true;
return 0;
}
@@ -370,6 +371,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
{
const struct sfp_upstream_ops *ops = bus->upstream_ops;
+ bus->netdev->sfp_bus = NULL;
if (bus->registered) {
if (bus->started)
bus->socket_ops->stop(bus->sfp);
@@ -451,7 +453,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus)
{
bus->upstream_ops = NULL;
bus->upstream = NULL;
- bus->netdev->sfp_bus = NULL;
bus->netdev = NULL;
}
@@ -480,7 +481,6 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode,
bus->upstream_ops = ops;
bus->upstream = upstream;
bus->netdev = ndev;
- ndev->sfp_bus = bus;
if (bus->sfp) {
ret = sfp_register_bus(bus);
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 13.8Mbps down 630kbps up
According to speedtest.net: 13Mbps down 490kbps up
next prev parent reply other threads:[~2018-09-15 7:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-14 23:01 [PATCH net] net: phy: sfp: Prevent NULL deference of socket_ops Florian Fainelli
2018-09-15 7:32 ` Russell King - ARM Linux [this message]
2018-09-17 17:30 ` Florian Fainelli
2018-09-17 23:13 ` Russell King - ARM Linux
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180915073228.GE30658@n2100.armlinux.org.uk \
--to=linux@armlinux.org.uk \
--cc=andrew@lunn.ch \
--cc=davem@davemloft.net \
--cc=f.fainelli@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).