lkml.org 
[lkml]   [2018]   [May]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 189/329] net: smsc911x: Fix unload crash when link is up
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jeremy Linton <jeremy.linton@arm.com>

    [ Upstream commit e06513d78d54e6c7026c9043a39e2c01ee25bdbe ]

    The smsc911x driver will crash if it is rmmod'ed while the netdev
    is up like:

    Call trace:
    phy_detach+0x94/0x150
    phy_disconnect+0x40/0x50
    smsc911x_stop+0x104/0x128 [smsc911x]
    __dev_close_many+0xb4/0x138
    dev_close_many+0xbc/0x190
    rollback_registered_many+0x140/0x460
    rollback_registered+0x68/0xb0
    unregister_netdevice_queue+0x100/0x118
    unregister_netdev+0x28/0x38
    smsc911x_drv_remove+0x58/0x130 [smsc911x]
    platform_drv_remove+0x30/0x50
    device_release_driver_internal+0x15c/0x1f8
    driver_detach+0x54/0x98
    bus_remove_driver+0x64/0xe8
    driver_unregister+0x34/0x60
    platform_driver_unregister+0x20/0x30
    smsc911x_cleanup_module+0x14/0xbca8 [smsc911x]
    SyS_delete_module+0x1e8/0x238
    __sys_trace_return+0x0/0x4

    This is caused by the mdiobus being unregistered/free'd
    and the code in phy_detach() attempting to manipulate mdio
    related structures from unregister_netdev() calling close()

    To fix this, we delay the mdiobus teardown until after
    the netdev is deregistered.

    Reported-by: Matt Sealey <matt.sealey@arm.com>
    Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
    Reviewed-by: Andrew Lunn <andrew@lunn.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/smsc/smsc911x.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    --- a/drivers/net/ethernet/smsc/smsc911x.c
    +++ b/drivers/net/ethernet/smsc/smsc911x.c
    @@ -2330,14 +2330,14 @@ static int smsc911x_drv_remove(struct pl
    pdata = netdev_priv(dev);
    BUG_ON(!pdata);
    BUG_ON(!pdata->ioaddr);
    - WARN_ON(dev->phydev);

    SMSC_TRACE(pdata, ifdown, "Stopping driver");

    + unregister_netdev(dev);
    +
    mdiobus_unregister(pdata->mii_bus);
    mdiobus_free(pdata->mii_bus);

    - unregister_netdev(dev);
    res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
    "smsc911x-memory");
    if (!res)

    \
     
     \ /
      Last update: 2018-05-28 16:17    [W:4.027 / U:0.116 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site