2022-06-17 05:16:32

by Oleksij Rempel

[permalink] [raw]
Subject: [PATCH net-next v2 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

Latest kernel will explode on the PHY interrupt config, since it depends
now on allocated priv. So, run probe to allocate priv to fix it.

ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34
...
Call Trace:
[<8050e8a8>] at803x_config_intr+0x5c/0xd0
[<80504b34>] phy_request_interrupt+0xa8/0xd0
[<8050289c>] phylink_bringup_phy+0x2d8/0x3ac
[<80502b68>] phylink_fwnode_phy_connect+0x118/0x130
[<8074d8ec>] dsa_slave_create+0x270/0x420
[<80743b04>] dsa_port_setup+0x12c/0x148
[<8074580c>] dsa_register_switch+0xaf0/0xcc0
[<80511344>] ar9331_sw_probe+0x370/0x388
[<8050cb78>] mdio_probe+0x44/0x70
[<804df300>] really_probe+0x200/0x424
[<804df7b4>] __driver_probe_device+0x290/0x298
[<804df810>] driver_probe_device+0x54/0xe4
[<804dfd50>] __device_attach_driver+0xe4/0x130
[<804dcb00>] bus_for_each_drv+0xb4/0xd8
[<804dfac4>] __device_attach+0x104/0x1a4
[<804ddd24>] bus_probe_device+0x48/0xc4
[<804deb44>] deferred_probe_work_func+0xf0/0x10c
[<800a0ffc>] process_one_work+0x314/0x4d4
[<800a17fc>] worker_thread+0x2a4/0x354
[<800a9a54>] kthread+0x134/0x13c
[<8006306c>] ret_from_kernel_thread+0x14/0x1c

Same Issue would affect some other PHYs (QCA8081, QCA9561), so fix it
too.

Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")
Signed-off-by: Oleksij Rempel <[email protected]>
---
changes v2:
- add fixes for QCA8081 and QCA9561

drivers/net/phy/at803x.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6a467e7817a6..59fe356942b5 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -2072,6 +2072,8 @@ static struct phy_driver at803x_driver[] = {
/* ATHEROS AR9331 */
PHY_ID_MATCH_EXACT(ATH9331_PHY_ID),
.name = "Qualcomm Atheros AR9331 built-in PHY",
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2087,6 +2089,8 @@ static struct phy_driver at803x_driver[] = {
/* Qualcomm Atheros QCA9561 */
PHY_ID_MATCH_EXACT(QCA9561_PHY_ID),
.name = "Qualcomm Atheros QCA9561 built-in PHY",
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2151,6 +2155,8 @@ static struct phy_driver at803x_driver[] = {
PHY_ID_MATCH_EXACT(QCA8081_PHY_ID),
.name = "Qualcomm QCA8081",
.flags = PHY_POLL_CABLE_TEST,
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.config_intr = at803x_config_intr,
.handle_interrupt = at803x_handle_interrupt,
.get_tunable = at803x_get_tunable,
--
2.30.2


2022-06-17 18:03:33

by Andrew Lunn

[permalink] [raw]
Subject: Re: [PATCH net-next v2 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

On Fri, Jun 17, 2022 at 06:59:43AM +0200, Oleksij Rempel wrote:
> Latest kernel will explode on the PHY interrupt config, since it depends
> now on allocated priv. So, run probe to allocate priv to fix it.
>
> ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
> CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34
> ...
> Call Trace:
> [<8050e8a8>] at803x_config_intr+0x5c/0xd0
> [<80504b34>] phy_request_interrupt+0xa8/0xd0
> [<8050289c>] phylink_bringup_phy+0x2d8/0x3ac
> [<80502b68>] phylink_fwnode_phy_connect+0x118/0x130
> [<8074d8ec>] dsa_slave_create+0x270/0x420
> [<80743b04>] dsa_port_setup+0x12c/0x148
> [<8074580c>] dsa_register_switch+0xaf0/0xcc0
> [<80511344>] ar9331_sw_probe+0x370/0x388
> [<8050cb78>] mdio_probe+0x44/0x70
> [<804df300>] really_probe+0x200/0x424
> [<804df7b4>] __driver_probe_device+0x290/0x298
> [<804df810>] driver_probe_device+0x54/0xe4
> [<804dfd50>] __device_attach_driver+0xe4/0x130
> [<804dcb00>] bus_for_each_drv+0xb4/0xd8
> [<804dfac4>] __device_attach+0x104/0x1a4
> [<804ddd24>] bus_probe_device+0x48/0xc4
> [<804deb44>] deferred_probe_work_func+0xf0/0x10c
> [<800a0ffc>] process_one_work+0x314/0x4d4
> [<800a17fc>] worker_thread+0x2a4/0x354
> [<800a9a54>] kthread+0x134/0x13c
> [<8006306c>] ret_from_kernel_thread+0x14/0x1c
>
> Same Issue would affect some other PHYs (QCA8081, QCA9561), so fix it
> too.
>
> Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")
> Signed-off-by: Oleksij Rempel <[email protected]>

Reviewed-by: Andrew Lunn <[email protected]>

Andrew

2022-06-18 03:53:06

by Jakub Kicinski

[permalink] [raw]
Subject: Re: [PATCH net-next v2 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

On Fri, 17 Jun 2022 06:59:43 +0200 Oleksij Rempel wrote:
> Subject: [PATCH net-next v2 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

> Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")

The patch under Fixes is in net, why target net-next?

Please repost with [PATCH net]