* Re: [PATCH net-next] net: stmmac: Fix kernel panic due to NULL pointer dereference of fpe_cfg
2021-03-26 9:10 ` [PATCH net-next] net: stmmac: Fix kernel panic due to NULL pointer dereference of fpe_cfg mohammad.athari.ismail
@ 2021-03-26 10:55 ` Marek Szyprowski
2021-03-26 23:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Marek Szyprowski @ 2021-03-26 10:55 UTC (permalink / raw)
To: mohammad.athari.ismail, Giuseppe Cavallaro, Alexandre Torgue,
Jose Abreu, David S . Miller, Jakub Kicinski, Maxime Coquelin,
Russell King
Cc: Ong Boon Leong, Voon Weifeng, vee.khee.wong, Tan Tee Min, netdev,
linux-stm32, linux-arm-kernel, linux-kernel
On 26.03.2021 10:10, mohammad.athari.ismail@intel.com wrote:
> From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
>
> In this patch, "net: stmmac: support FPE link partner hand-shaking
> procedure", priv->plat->fpe_cfg wouldn`t be "devm_kzalloc"ed if
> dma_cap->frpsel is 0 (Flexible Rx Parser is not supported in SoC) in
> tc_init(). So, fpe_cfg will be remain as NULL and accessing it will cause
> kernel panic.
>
> To fix this, move the "devm_kzalloc"ing of priv->plat->fpe_cfg before
> dma_cap->frpsel checking in tc_init(). Additionally, checking of
> priv->dma_cap.fpesel is added before calling stmmac_fpe_link_state_handle()
> as only FPE supported SoC is allowed to call the function.
>
> Below is the kernel panic dump reported by Marek Szyprowski
> <m.szyprowski@samsung.com>:
>
> meson8b-dwmac ff3f0000.ethernet eth0: PHY [0.0:00] driver [RTL8211F Gigabit Ethernet] (irq=35)
> meson8b-dwmac ff3f0000.ethernet eth0: No Safety Features support found
> meson8b-dwmac ff3f0000.ethernet eth0: PTP not supported by HW
> meson8b-dwmac ff3f0000.ethernet eth0: configuring for phy/rgmii link mode
> Unable to handle kernel NULL pointer dereference at virtual address 0000000000000001
> Mem abort info:
> ...
> user pgtable: 4k pages, 48-bit VAs, pgdp=00000000044eb000
> [0000000000000001] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 96000004 [#1] PREEMPT SMP
> Modules linked in: dw_hdmi_i2s_audio dw_hdmi_cec meson_gxl realtek meson_gxbb_wdt snd_soc_meson_axg_sound_card dwmac_generic axg_audio meson_dw_hdmi crct10dif_ce snd_soc_meson_card_utils snd_soc_meson_axg_tdmout panfrost rc_odroid gpu_sched reset_meson_audio_arb meson_ir snd_soc_meson_g12a_tohdmitx snd_soc_meson_axg_frddr sclk_div clk_phase snd_soc_meson_codec_glue dwmac_meson8b snd_soc_meson_axg_fifo stmmac_platform meson_rng meson_drm stmmac rtc_meson_vrtc rng_core meson_canvas pwm_meson dw_hdmi mdio_mux_meson_g12a pcs_xpcs snd_soc_meson_axg_tdm_interface snd_soc_meson_axg_tdm_formatter nvmem_meson_efuse display_connector
> CPU: 1 PID: 7 Comm: kworker/u8:0 Not tainted 5.12.0-rc4-next-20210325+
> Hardware name: Hardkernel ODROID-C4 (DT)
> Workqueue: events_power_efficient phylink_resolve
> pstate: 20400009 (nzCv daif +PAN -UAO -TCO BTYPE=--)
> pc : stmmac_mac_link_up+0x14c/0x348 [stmmac]
> lr : stmmac_mac_link_up+0x284/0x348 [stmmac] ...
> Call trace:
> stmmac_mac_link_up+0x14c/0x348 [stmmac]
> phylink_resolve+0x104/0x420
> process_one_work+0x2a8/0x718
> worker_thread+0x48/0x460
> kthread+0x134/0x160
> ret_from_fork+0x10/0x18
> Code: b971ba60 350007c0 f958c260 f9402000 (39400401)
> ---[ end trace 0c9deb6c510228aa ]---
>
> Fixes: 5a5586112b92 ("net: stmmac: support FPE link partner hand-shaking
> procedure")
> Reported-by: Marek Szyprowski <m.szyprowski@samsung.com>
> Signed-off-by: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
This fixes my issue. Thanks!
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
> ---
> .../net/ethernet/stmicro/stmmac/stmmac_main.c | 6 ++++--
> .../net/ethernet/stmicro/stmmac/stmmac_tc.c | 20 +++++++++----------
> 2 files changed, 14 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 170296820af0..27faf5e49360 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -997,7 +997,8 @@ static void stmmac_mac_link_down(struct phylink_config *config,
> stmmac_eee_init(priv);
> stmmac_set_eee_pls(priv, priv->hw, false);
>
> - stmmac_fpe_link_state_handle(priv, false);
> + if (priv->dma_cap.fpesel)
> + stmmac_fpe_link_state_handle(priv, false);
> }
>
> static void stmmac_mac_link_up(struct phylink_config *config,
> @@ -1097,7 +1098,8 @@ static void stmmac_mac_link_up(struct phylink_config *config,
> stmmac_set_eee_pls(priv, priv->hw, true);
> }
>
> - stmmac_fpe_link_state_handle(priv, true);
> + if (priv->dma_cap.fpesel)
> + stmmac_fpe_link_state_handle(priv, true);
> }
>
> static const struct phylink_mac_ops stmmac_phylink_mac_ops = {
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
> index 1d84ee359808..4e70efc45458 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c
> @@ -254,6 +254,16 @@ static int tc_init(struct stmmac_priv *priv)
> priv->flow_entries_max);
> }
>
> + if (!priv->plat->fpe_cfg) {
> + priv->plat->fpe_cfg = devm_kzalloc(priv->device,
> + sizeof(*priv->plat->fpe_cfg),
> + GFP_KERNEL);
> + if (!priv->plat->fpe_cfg)
> + return -ENOMEM;
> + } else {
> + memset(priv->plat->fpe_cfg, 0, sizeof(*priv->plat->fpe_cfg));
> + }
> +
> /* Fail silently as we can still use remaining features, e.g. CBS */
> if (!dma_cap->frpsel)
> return 0;
> @@ -298,16 +308,6 @@ static int tc_init(struct stmmac_priv *priv)
> dev_info(priv->device, "Enabling HW TC (entries=%d, max_off=%d)\n",
> priv->tc_entries_max, priv->tc_off_max);
>
> - if (!priv->plat->fpe_cfg) {
> - priv->plat->fpe_cfg = devm_kzalloc(priv->device,
> - sizeof(*priv->plat->fpe_cfg),
> - GFP_KERNEL);
> - if (!priv->plat->fpe_cfg)
> - return -ENOMEM;
> - } else {
> - memset(priv->plat->fpe_cfg, 0, sizeof(*priv->plat->fpe_cfg));
> - }
> -
> return 0;
> }
>
Best regards
--
Marek Szyprowski, PhD
Samsung R&D Institute Poland
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH net-next] net: stmmac: Fix kernel panic due to NULL pointer dereference of fpe_cfg
2021-03-26 9:10 ` [PATCH net-next] net: stmmac: Fix kernel panic due to NULL pointer dereference of fpe_cfg mohammad.athari.ismail
2021-03-26 10:55 ` Marek Szyprowski
@ 2021-03-26 23:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-03-26 23:00 UTC (permalink / raw)
To: Ismail, Mohammad Athari
Cc: peppe.cavallaro, alexandre.torgue, joabreu, davem, kuba,
mcoquelin.stm32, linux, m.szyprowski, boon.leong.ong,
weifeng.voon, vee.khee.wong, tee.min.tan, netdev, linux-stm32,
linux-arm-kernel, linux-kernel
Hello:
This patch was applied to netdev/net-next.git (refs/heads/master):
On Fri, 26 Mar 2021 17:10:46 +0800 you wrote:
> From: Mohammad Athari Bin Ismail <mohammad.athari.ismail@intel.com>
>
> In this patch, "net: stmmac: support FPE link partner hand-shaking
> procedure", priv->plat->fpe_cfg wouldn`t be "devm_kzalloc"ed if
> dma_cap->frpsel is 0 (Flexible Rx Parser is not supported in SoC) in
> tc_init(). So, fpe_cfg will be remain as NULL and accessing it will cause
> kernel panic.
>
> [...]
Here is the summary with links:
- [net-next] net: stmmac: Fix kernel panic due to NULL pointer dereference of fpe_cfg
https://git.kernel.org/netdev/net-next/c/63c173ff7aa3
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread