All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Sergej Bauer <sbauer@blackbox.su>,
	Jakub Kicinski <kuba@kernel.org>
Subject: [PATCH 5.9 30/49] lan743x: fix for potential NULL pointer dereference with bare card
Date: Sat, 19 Dec 2020 13:58:34 +0100	[thread overview]
Message-ID: <20201219125346.153511072@linuxfoundation.org> (raw)
In-Reply-To: <20201219125344.671832095@linuxfoundation.org>

From: Sergej Bauer <sbauer@blackbox.su>

[ Upstream commit e9e13b6adc338be1eb88db87bcb392696144bd02 ]

This is the 3rd revision of the patch fix for potential null pointer dereference
with lan743x card.

The simpliest way to reproduce: boot with bare lan743x and issue "ethtool ethN"
commant where ethN is the interface with lan743x card. Example:

$ sudo ethtool eth7
dmesg:
[  103.510336] BUG: kernel NULL pointer dereference, address: 0000000000000340
...
[  103.510836] RIP: 0010:phy_ethtool_get_wol+0x5/0x30 [libphy]
...
[  103.511629] Call Trace:
[  103.511666]  lan743x_ethtool_get_wol+0x21/0x40 [lan743x]
[  103.511724]  dev_ethtool+0x1507/0x29d0
[  103.511769]  ? avc_has_extended_perms+0x17f/0x440
[  103.511820]  ? tomoyo_init_request_info+0x84/0x90
[  103.511870]  ? tomoyo_path_number_perm+0x68/0x1e0
[  103.511919]  ? tty_insert_flip_string_fixed_flag+0x82/0xe0
[  103.511973]  ? inet_ioctl+0x187/0x1d0
[  103.512016]  dev_ioctl+0xb5/0x560
[  103.512055]  sock_do_ioctl+0xa0/0x140
[  103.512098]  sock_ioctl+0x2cb/0x3c0
[  103.512139]  __x64_sys_ioctl+0x84/0xc0
[  103.512183]  do_syscall_64+0x33/0x80
[  103.512224]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  103.512274] RIP: 0033:0x7f54a9cba427
...

Previous versions can be found at:
v1:
initial version
    https://lkml.org/lkml/2020/10/28/921

v2:
do not return from lan743x_ethtool_set_wol if netdev->phydev == NULL, just skip
the call of phy_ethtool_set_wol() instead.
    https://lkml.org/lkml/2020/10/31/380

v3:
in function lan743x_ethtool_set_wol:
use ternary operator instead of if-else sentence (review by Markus Elfring)
return -ENETDOWN insted of -EIO (review by Andrew Lunn)

Signed-off-by: Sergej Bauer <sbauer@blackbox.su>

Link: https://lore.kernel.org/r/20201101223556.16116-1-sbauer@blackbox.su
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/microchip/lan743x_ethtool.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/net/ethernet/microchip/lan743x_ethtool.c
+++ b/drivers/net/ethernet/microchip/lan743x_ethtool.c
@@ -780,7 +780,9 @@ static void lan743x_ethtool_get_wol(stru
 
 	wol->supported = 0;
 	wol->wolopts = 0;
-	phy_ethtool_get_wol(netdev->phydev, wol);
+
+	if (netdev->phydev)
+		phy_ethtool_get_wol(netdev->phydev, wol);
 
 	wol->supported |= WAKE_BCAST | WAKE_UCAST | WAKE_MCAST |
 		WAKE_MAGIC | WAKE_PHY | WAKE_ARP;
@@ -809,9 +811,8 @@ static int lan743x_ethtool_set_wol(struc
 
 	device_set_wakeup_enable(&adapter->pdev->dev, (bool)wol->wolopts);
 
-	phy_ethtool_set_wol(netdev->phydev, wol);
-
-	return 0;
+	return netdev->phydev ? phy_ethtool_set_wol(netdev->phydev, wol)
+			: -ENETDOWN;
 }
 #endif /* CONFIG_PM */
 



  parent reply	other threads:[~2020-12-19 13:00 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-19 12:58 [PATCH 5.9 00/49] 5.9.16-rc1 review Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 01/49] ptrace: Prevent kernel-infoleak in ptrace_get_syscall_info() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 02/49] net/sched: fq_pie: initialize timer earlier in fq_pie_init() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 03/49] net: ipa: pass the correct size when freeing DMA memory Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 04/49] ipv4: fix error return code in rtm_to_fib_config() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 05/49] mac80211: mesh: fix mesh_pathtbl_init() error path Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 06/49] net: bridge: vlan: fix error return code in __vlan_add() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 07/49] vrf: packets with lladdr src needs dst at input with orig_iif when needs strict Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 08/49] net: mscc: ocelot: fix dropping of unknown IPv4 multicast on Seville Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 09/49] net: hns3: remove a misused pragma packed Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 10/49] udp: fix the proto value passed to ip_protocol_deliver_rcu for the segments Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 11/49] enetc: Fix reporting of h/w packet counters Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 12/49] bridge: Fix a deadlock when enabling multicast snooping Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 13/49] mptcp: print new line in mptcp_seq_show() if mptcp isnt in use Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 14/49] net: stmmac: dwmac-meson8b: fix mask definition of the m250_sel mux Greg Kroah-Hartman
2020-12-19 21:51   ` Pavel Machek
2020-12-19 22:38     ` Martin Blumenstingl
2020-12-19 23:13       ` Pavel Machek
2020-12-21 14:31         ` Martin Blumenstingl
2020-12-19 12:58 ` [PATCH 5.9 15/49] net: stmmac: start phylink instance before stmmac_hw_setup() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 16/49] net: stmmac: free tx skb buffer in stmmac_resume() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 17/49] net: stmmac: delete the eee_ctrl_timer after napi disabled Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 18/49] net: stmmac: overwrite the dma_cap.addr64 according to HW design Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 19/49] net: ll_temac: Fix potential NULL dereference in temac_probe() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 20/49] tcp: select sane initial rcvq_space.space for big MSS Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 21/49] e1000e: fix S0ix flow to allow S0i3.2 subset entry Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 22/49] ethtool: fix stack overflow in ethnl_parse_bitset() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 23/49] tcp: fix cwnd-limited bug for TSO deferral where we send nothing Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 24/49] net: flow_offload: Fix memory leak for indirect flow block Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 25/49] net/mlx4_en: Avoid scheduling restart task if it is already running Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 26/49] net/mlx4_en: Handle TX error CQE Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 27/49] net: sched: Fix dump of MPLS_OPT_LSE_LABEL attribute in cls_flower Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 28/49] bonding: fix feature flag setting at init time Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 29/49] ch_ktls: fix build warning for ipv4-only config Greg Kroah-Hartman
2020-12-19 12:58 ` Greg Kroah-Hartman [this message]
2020-12-19 12:58 ` [PATCH 5.9 31/49] net: stmmac: increase the timeout for dma reset Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 32/49] net: tipc: prevent possible null deref of link Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 33/49] ktest.pl: If size of log is too big to email, email error message Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 34/49] ktest.pl: Fix the logic for truncating the size of the log file for email Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 35/49] USB: dummy-hcd: Fix uninitialized array use in init() Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 36/49] USB: add RESET_RESUME quirk for Snapscan 1212 Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 37/49] ALSA: usb-audio: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 38/49] ALSA: usb-audio: Fix control access overflow errors from chmap Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 39/49] xhci: Give USB2 ports time to enter U3 in bus suspend Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 40/49] xhci-pci: Allow host runtime PM as default for Intel Alpine Ridge LP Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 41/49] xhci-pci: Allow host runtime PM as default for Intel Maple Ridge xHCI Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 42/49] USB: UAS: introduce a quirk to set no_write_same Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 43/49] USB: sisusbvga: Make console support depend on BROKEN Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 44/49] ALSA: pcm: oss: Fix potential out-of-bounds shift Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 45/49] serial: 8250_omap: Avoid FIFO corruption caused by MDR1 access Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 46/49] KVM: mmu: Fix SPTE encoding of MMIO generation upper half Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 47/49] membarrier: Explicitly sync remote cores when SYNC_CORE is requested Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 48/49] x86/resctrl: Remove unused struct mbm_state::chunks_bw Greg Kroah-Hartman
2020-12-19 12:58 ` [PATCH 5.9 49/49] x86/resctrl: Fix incorrect local bandwidth when mba_sc is enabled Greg Kroah-Hartman
2020-12-19 21:49 ` [PATCH 5.9 00/49] 5.9.16-rc1 review Guenter Roeck
2020-12-20  3:51 ` Naresh Kamboju
2020-12-20 13:37 ` Jon Hunter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201219125346.153511072@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sbauer@blackbox.su \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.