From: Florian Fainelli <f.fainelli@gmail.com>
To: Andrew Lunn <andrew@lunn.ch>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
Heiner Kallweit <hkallweit1@gmail.com>,
Christian Marangi <ansuelsmth@gmail.com>,
Vladimir Oltean <olteanv@gmail.com>, Pavel Machek <pavel@ucw.cz>,
Lee Jones <lee@kernel.org>,
"linux-leds@vger.kernel.org" <linux-leds@vger.kernel.org>
Subject: Re: NPD in phy_led_set_brightness+0x3c
Date: Thu, 8 Jun 2023 15:03:48 -0700 [thread overview]
Message-ID: <c4133154-3163-2f22-9d88-dfb17221111b@gmail.com> (raw)
In-Reply-To: <b0dd0247-90f6-4769-a1f3-3b3499561b88@lunn.ch>
On 6/8/23 12:13, Andrew Lunn wrote:
> On Thu, Jun 08, 2023 at 10:33:30AM -0700, Florian Fainelli wrote:
>> On 6/7/23 18:30, Andrew Lunn wrote:
>>>> (gdb) print /x (int)&((struct phy_driver *)0)->led_brightness_set
>>>> $1 = 0x1f0
>>>>
>>>> so this would indeed look like an use-after-free here. If you tested with a
>>>> PHYLINK enabled driver you might have no seen due to
>>>> phylink_disconnect_phy() being called with RTNL held?
>>>
>>> Yes, i've been testing with mvneta, which is phylink.
>>
>> Humm, this is really puzzling because we have the below call trace as to
>> where we call schedule_work() which is in led_set_brightness_nopm() however
>> we have led_classdev_unregister() call flush_work() to ensure the workqueue
>> completed. Is there something else in that call stack that prevents the
>> system workqueue from running?
>
> Has phy_remove() already been called? Last thing it does is:
>
> phydev->drv = NULL;
>
> This is one of the differences between my system and yours. With
> mvneta, the mdio bus driver is an independent device. You have a
> combined MAC and MDIO bus driver.
Yes, good point. I did change to the patch below, however that still
triggers an delayed led_brightness_set call which now gets scheduled
*after* we removed the MDIO bus controller and shutdown the MDIO bus clock:
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 2cad9cc3f6b8..f838c4f92524 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -3053,7 +3053,7 @@ static int of_phy_led(struct phy_device *phydev,
init_data.fwnode = of_fwnode_handle(led);
init_data.devname_mandatory = true;
- err = devm_led_classdev_register_ext(dev, cdev, &init_data);
+ err = led_classdev_register_ext(dev, cdev, &init_data);
if (err)
return err;
@@ -3298,6 +3298,14 @@ static int phy_probe(struct device *dev)
return err;
}
+static void phy_remove_leds(struct phy_device *phydev)
+{
+ struct phy_led *phyled;
+
+ list_for_each_entry(phyled, &phydev->leds, list)
+ led_classdev_unregister(&phyled->led_cdev);
+}
+
static int phy_remove(struct device *dev)
{
struct phy_device *phydev = to_phy_device(dev);
@@ -3315,6 +3323,8 @@ static int phy_remove(struct device *dev)
/* Assert the reset signal */
phy_device_reset(phydev, 1);
+ phy_remove_leds(phydev);
+
phydev->drv = NULL;
return 0;
--
Florian
prev parent reply other threads:[~2023-06-08 22:04 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-07 20:50 NPD in phy_led_set_brightness+0x3c Florian Fainelli
2023-06-07 21:32 ` Andrew Lunn
2023-06-07 22:29 ` Florian Fainelli
2023-06-08 1:30 ` Andrew Lunn
2023-06-08 17:33 ` Florian Fainelli
2023-06-08 19:13 ` Andrew Lunn
2023-06-08 22:03 ` Florian Fainelli [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c4133154-3163-2f22-9d88-dfb17221111b@gmail.com \
--to=f.fainelli@gmail.com \
--cc=andrew@lunn.ch \
--cc=ansuelsmth@gmail.com \
--cc=hkallweit1@gmail.com \
--cc=lee@kernel.org \
--cc=linux-leds@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=olteanv@gmail.com \
--cc=pavel@ucw.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).