mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Sergej Bauer <sbauer@blackbox.su>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.9 30/49] lan743x: fix for potential NULL pointer dereference with bare card
Date: Sat, 19 Dec 2020 13:58:34 +0100	[thread overview]
Message-ID: <20201219125346.153511072@linuxfoundation.org> (raw)
In-Reply-To: <20201219125344.671832095@linuxfoundation.org>

From: Sergej Bauer <sbauer@blackbox.su>

[ Upstream commit e9e13b6adc338be1eb88db87bcb392696144bd02 ]

This is the 3rd revision of the patch fix for potential null pointer dereference
with lan743x card.

The simpliest way to reproduce: boot with bare lan743x and issue "ethtool ethN"
commant where ethN is the interface with lan743x card. Example:

$ sudo ethtool eth7
dmesg:
[  103.510336] BUG: kernel NULL pointer dereference, address: 0000000000000340
...
[  103.510836] RIP: 0010:phy_ethtool_get_wol+0x5/0x30 [libphy]
...
[  103.511629] Call Trace:
[  103.511666]  lan743x_ethtool_get_wol+0x21/0x40 [lan743x]
[  103.511724]  dev_ethtool+0x1507/0x29d0
[  103.511769]  ? avc_has_extended_perms+0x17f/0x440
[  103.511820]  ? tomoyo_init_request_info+0x84/0x90
[  103.511870]  ? tomoyo_path_number_perm+0x68/0x1e0
[  103.511919]  ? tty_insert_flip_string_fixed_flag+0x82/0xe0
[  103.511973]  ? inet_ioctl+0x187/0x1d0
[  103.512016]  dev_ioctl+0xb5/0x560
[  103.512055]  sock_do_ioctl+0xa0/0x140
[  103.512098]  sock_ioctl+0x2cb/0x3c0
[  103.512139]  __x64_sys_ioctl+0x84/0xc0
[  103.512183]  do_syscall_64+0x33/0x80
[  103.512224]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  103.512274] RIP: 0033:0x7f54a9cba427
...

Previous versions can be found at:
v1:
initial version
    https://lkml.org/lkml/2020/10/28/921

v2:
do not return from lan743x_ethtool_set_wol if netdev->phydev == NULL, just skip
the call of phy_ethtool_set_wol() instead.
    https://lkml.org/lkml/2020/10/31/380

v3:
in function lan743x_ethtool_set_wol:
use ternary operator instead of if-else sentence (review by Markus Elfring)
return -ENETDOWN insted of -EIO (review by Andrew Lunn)

Signed-off-by: Sergej Bauer <sbauer@blackbox.su>

Link: https://lore.kernel.org/r/20201101223556.16116-1-sbauer@blackbox.su
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_ethtool.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
+++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
@@ -780,7 +780,9 @@ static void lan743x_ethtool_get_wol(stru
 
 	wol->supported = 0;
 	wol->wolopts = 0;
-	phy_ethtool_get_wol(netdev->phydev, wol);
+
+	if (netdev->phydev)
+		phy_ethtool_get_wol(netdev->phydev, wol);
 
 	wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
 		WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
@@ -809,9 +811,8 @@ static int lan743x_ethtool_set_wol(struc
 
 	device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
 
-	phy_ethtool_set_wol(netdev->phydev, wol);
-
-	return 0;
+	return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
+			: -ENETDOWN;
 }
 #endif /* CONFIG_PM */
 



  parent reply	other threads:[~2020-12-19 13:00 UTC|newest]

Thread overview: 56+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-19 12:58 [PATCH 5.9 00/49] 5.9.16-rc1 review Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 01/49] ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 02/49] net/sched: fq_pie: initialize timer earlier in fq_pie_init() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 03/49] net: ipa: pass the correct size when freeing DMA memory Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 04/49] ipv4: fix error return code in rtm_to_fib_config() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 05/49] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 06/49] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 07/49] vrf: packets with lladdr src needs dst at input with orig_iif when needs strict Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 08/49] net: mscc: ocelot: fix dropping of unknown IPv4 multicast on Seville Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 09/49] net: hns3: remove a misused pragma packed Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 10/49] udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 11/49] enetc: Fix reporting of h/w packet counters Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 12/49] bridge: Fix a deadlock when enabling multicast snooping Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 13/49] mptcp: print new line in mptcp_seq_show() if mptcp isnt in use Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 14/49] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
2020-12-19 21:51   ` Pavel Machek
2020-12-19 22:38     ` Martin Blumenstingl
2020-12-19 23:13       ` Pavel Machek
2020-12-21 14:31         ` Martin Blumenstingl
2020-12-19 12:58 ` [PATCH 5.9 15/49] net: stmmac: start phylink instance before stmmac_hw_setup() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 16/49] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 17/49] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 18/49] net: stmmac: overwrite the dma_cap.addr64 according to HW design Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 19/49] net: ll_temac: Fix potential NULL dereference in temac_probe() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 20/49] tcp: select sane initial rcvq_space.space for big MSS Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 21/49] e1000e: fix S0ix flow to allow S0i3.2 subset entry Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 22/49] ethtool: fix stack overflow in ethnl_parse_bitset() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 23/49] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 24/49] net: flow_offload: Fix memory leak for indirect flow block Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 25/49] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 26/49] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 27/49] net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 28/49] bonding: fix feature flag setting at init time Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 29/49] ch_ktls: fix build warning for ipv4-only config Greg Kroah-Hartman
2020-12-19 12:58 ` Greg Kroah-Hartman [this message]
2020-12-19 12:58 ` [PATCH 5.9 31/49] net: stmmac: increase the timeout for dma reset Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 32/49] net: tipc: prevent possible null deref of link Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 33/49] ktest.pl: If size of log is too big to email, email error message Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 34/49] ktest.pl: Fix the logic for truncating the size of the log file for email Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 35/49] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 36/49] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 37/49] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 38/49] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 39/49] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 40/49] xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 41/49] xhci-pci: Allow host runtime PM as default for Intel Maple Ridge xHCI Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 42/49] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 43/49] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 44/49] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 45/49] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 46/49] KVM: mmu: Fix SPTE encoding of MMIO generation upper half Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 47/49] membarrier: Explicitly sync remote cores when SYNC_CORE is requested Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 48/49] x86/resctrl: Remove unused struct mbm_state::chunks_bw Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 49/49] x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled Greg Kroah-Hartman
2020-12-19 21:49 ` [PATCH 5.9 00/49] 5.9.16-rc1 review Guenter Roeck
2020-12-20  3:51 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201219125346.153511072@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sbauer@blackbox.su \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

Powered by JetHome