Messages in this thread | | | Subject | Re: [PATCH net] net: phy: sfp: Prevent NULL deference of socket_ops | From | Florian Fainelli <> | Date | Mon, 17 Sep 2018 10:30:52 -0700 |
| |
On 09/15/2018 12:32 AM, Russell King - ARM Linux wrote: > On Fri, Sep 14, 2018 at 04:01:31PM -0700, Florian Fainelli wrote: >> In case we have specified a SFP and an I2C phandle in the Device Tree, >> but we somehow failed to look up the I2C adapter (e.g: the driver is not >> enabled), we will leave dangling socket_ops, and the sfp_bus will still >> have been registered. We can then observe NULL pointer dereferences >> while doing ethtool -m: >> >> [ 20.218613] Unable to handle kernel NULL pointer dereference at virtual address 00000008 >> [ 20.226977] pgd = (ptrval) >> [ 20.229785] [00000008] *pgd=7c400831, *pte=00000000, *ppte=00000000 >> [ 20.236274] Internal error: Oops: 17 [#1] SMP ARM >> [ 20.241122] Modules linked in: >> [ 20.244278] CPU: 0 PID: 1480 Comm: ethtool Not tainted 4.19.0-rc3 #138 >> [ 20.251013] Hardware name: Broadcom Northstar Plus SoC >> [ 20.256316] PC is at sfp_get_module_info+0x8/0x10 >> [ 20.261172] LR is at dev_ethtool+0x218c/0x2afc >> >> Specifically guard against that. > > The other alternative to this would be to only set ndev->sfp_bus when > the bus moves to registered state, which would probably be a saner > alternative than to add an additional layer of tests. IOW:
Indeed, your patch works for me:
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
> > drivers/net/phy/sfp-bus.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c > index 48ca980f5c96..c4c2b5269216 100644 > --- a/drivers/net/phy/sfp-bus.c > +++ b/drivers/net/phy/sfp-bus.c > @@ -362,6 +362,7 @@ static int sfp_register_bus(struct sfp_bus *bus) > } > if (bus->started) > bus->socket_ops->start(bus->sfp); > + bus->netdev->sfp_bus = bus; > bus->registered = true; > return 0; > } > @@ -370,6 +371,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus) > { > const struct sfp_upstream_ops *ops = bus->upstream_ops; > > + bus->netdev->sfp_bus = NULL; > if (bus->registered) { > if (bus->started) > bus->socket_ops->stop(bus->sfp); > @@ -451,7 +453,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus) > { > bus->upstream_ops = NULL; > bus->upstream = NULL; > - bus->netdev->sfp_bus = NULL; > bus->netdev = NULL; > } > > @@ -480,7 +481,6 @@ struct sfp_bus *sfp_register_upstream(struct fwnode_handle *fwnode, > bus->upstream_ops = ops; > bus->upstream = upstream; > bus->netdev = ndev; > - ndev->sfp_bus = bus; > > if (bus->sfp) { > ret = sfp_register_bus(bus); >
-- Florian
| |