2022-06-18 12:29:16

by Oleksij Rempel

[permalink] [raw]
Subject: [PATCH net v3 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

Latest kernel will explode on the PHY interrupt config, since it depends
now on allocated priv. So, run probe to allocate priv to fix it.

ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34
...
Call Trace:
[<8050e8a8>] at803x_config_intr+0x5c/0xd0
[<80504b34>] phy_request_interrupt+0xa8/0xd0
[<8050289c>] phylink_bringup_phy+0x2d8/0x3ac
[<80502b68>] phylink_fwnode_phy_connect+0x118/0x130
[<8074d8ec>] dsa_slave_create+0x270/0x420
[<80743b04>] dsa_port_setup+0x12c/0x148
[<8074580c>] dsa_register_switch+0xaf0/0xcc0
[<80511344>] ar9331_sw_probe+0x370/0x388
[<8050cb78>] mdio_probe+0x44/0x70
[<804df300>] really_probe+0x200/0x424
[<804df7b4>] __driver_probe_device+0x290/0x298
[<804df810>] driver_probe_device+0x54/0xe4
[<804dfd50>] __device_attach_driver+0xe4/0x130
[<804dcb00>] bus_for_each_drv+0xb4/0xd8
[<804dfac4>] __device_attach+0x104/0x1a4
[<804ddd24>] bus_probe_device+0x48/0xc4
[<804deb44>] deferred_probe_work_func+0xf0/0x10c
[<800a0ffc>] process_one_work+0x314/0x4d4
[<800a17fc>] worker_thread+0x2a4/0x354
[<800a9a54>] kthread+0x134/0x13c
[<8006306c>] ret_from_kernel_thread+0x14/0x1c

Same Issue would affect some other PHYs (QCA8081, QCA9561), so fix it
too.

Fixes: 3265f4218878 ("net: phy: at803x: add fiber support")
Signed-off-by: Oleksij Rempel <[email protected]>
Reviewed-by: Andrew Lunn <[email protected]>
---
drivers/net/phy/at803x.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c
index 6a467e7817a6..59fe356942b5 100644
--- a/drivers/net/phy/at803x.c
+++ b/drivers/net/phy/at803x.c
@@ -2072,6 +2072,8 @@ static struct phy_driver at803x_driver[] = {
/* ATHEROS AR9331 */
PHY_ID_MATCH_EXACT(ATH9331_PHY_ID),
.name = "Qualcomm Atheros AR9331 built-in PHY",
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2087,6 +2089,8 @@ static struct phy_driver at803x_driver[] = {
/* Qualcomm Atheros QCA9561 */
PHY_ID_MATCH_EXACT(QCA9561_PHY_ID),
.name = "Qualcomm Atheros QCA9561 built-in PHY",
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.suspend = at803x_suspend,
.resume = at803x_resume,
.flags = PHY_POLL_CABLE_TEST,
@@ -2151,6 +2155,8 @@ static struct phy_driver at803x_driver[] = {
PHY_ID_MATCH_EXACT(QCA8081_PHY_ID),
.name = "Qualcomm QCA8081",
.flags = PHY_POLL_CABLE_TEST,
+ .probe = at803x_probe,
+ .remove = at803x_remove,
.config_intr = at803x_config_intr,
.handle_interrupt = at803x_handle_interrupt,
.get_tunable = at803x_get_tunable,
--
2.30.2


2022-06-19 11:08:16

by patchwork-bot+netdevbpf

[permalink] [raw]
Subject: Re: [PATCH net v3 1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY

Hello:

This patch was applied to netdev/net.git (master)
by David S. Miller <[email protected]>:

On Sat, 18 Jun 2022 14:23:33 +0200 you wrote:
> Latest kernel will explode on the PHY interrupt config, since it depends
> now on allocated priv. So, run probe to allocate priv to fix it.
>
> ar9331_switch ethernet.1:10 lan0 (uninitialized): PHY [!ahb!ethernet@1a000000!mdio!switch@10:00] driver [Qualcomm Atheros AR9331 built-in PHY] (irq=13)
> CPU 0 Unable to handle kernel paging request at virtual address 0000000a, epc == 8050e8a8, ra == 80504b34
> ...
> Call Trace:
> [<8050e8a8>] at803x_config_intr+0x5c/0xd0
> [<80504b34>] phy_request_interrupt+0xa8/0xd0
> [<8050289c>] phylink_bringup_phy+0x2d8/0x3ac
> [<80502b68>] phylink_fwnode_phy_connect+0x118/0x130
> [<8074d8ec>] dsa_slave_create+0x270/0x420
> [<80743b04>] dsa_port_setup+0x12c/0x148
> [<8074580c>] dsa_register_switch+0xaf0/0xcc0
> [<80511344>] ar9331_sw_probe+0x370/0x388
> [<8050cb78>] mdio_probe+0x44/0x70
> [<804df300>] really_probe+0x200/0x424
> [<804df7b4>] __driver_probe_device+0x290/0x298
> [<804df810>] driver_probe_device+0x54/0xe4
> [<804dfd50>] __device_attach_driver+0xe4/0x130
> [<804dcb00>] bus_for_each_drv+0xb4/0xd8
> [<804dfac4>] __device_attach+0x104/0x1a4
> [<804ddd24>] bus_probe_device+0x48/0xc4
> [<804deb44>] deferred_probe_work_func+0xf0/0x10c
> [<800a0ffc>] process_one_work+0x314/0x4d4
> [<800a17fc>] worker_thread+0x2a4/0x354
> [<800a9a54>] kthread+0x134/0x13c
> [<8006306c>] ret_from_kernel_thread+0x14/0x1c
>
> [...]

Here is the summary with links:
- [net,v3,1/1] net: phy: at803x: fix NULL pointer dereference on AR9331 PHY
https://git.kernel.org/netdev/net/c/9926de7315be

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html