All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Russell King (Oracle)" <linux@armlinux.org.uk>
To: Nicolas Ferre <nicolas.ferre@microchip.com>
Cc: Vladimir Oltean <vladimir.oltean@nxp.com>,
	netdev@vger.kernel.org, "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Andrew Lunn <andrew@lunn.ch>,
	Heiner Kallweit <hkallweit1@gmail.com>,
	Claudiu Beznea <Claudiu.Beznea@microchip.com>,
	Santiago Esteban <Santiago.Esteban@microchip.com>
Subject: Re: [PATCH net-next] net: phylink: fix NULL pl->pcs dereference during phylink_pcs_poll_start
Date: Thu, 30 Jun 2022 15:50:43 +0100	[thread overview]
Message-ID: <Yr24QzzcS1dMVtl0@shell.armlinux.org.uk> (raw)
In-Reply-To: <bfe3b0a0-5f42-6c32-6de7-4d989544e488@microchip.com>

On Thu, Jun 30, 2022 at 03:46:54PM +0200, Nicolas Ferre wrote:
> Vladimir, Russell,
> 
> On 29/06/2022 at 21:33, Vladimir Oltean wrote:
> > The current link mode of the phylink instance may not require an
> > attached PCS. However, phylink_major_config() unconditionally
> > dereferences this potentially NULL pointer when restarting the link poll
> > timer, which will panic the kernel.
> > 
> > Fix the problem by checking whether a PCS exists in phylink_pcs_poll_start(),
> > otherwise do nothing. The code prior to the blamed patch also only
> > looked at pcs->poll within an "if (pcs)" block.
> > 
> > Fixes: bfac8c490d60 ("net: phylink: disable PCS polling over major configuration")
> > Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
> > ---
> >   drivers/net/phy/phylink.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
> > index 1a7550f5fdf5..48f0b9b39491 100644
> > --- a/drivers/net/phy/phylink.c
> > +++ b/drivers/net/phy/phylink.c
> > @@ -766,7 +766,7 @@ static void phylink_pcs_poll_stop(struct phylink *pl)
> >   static void phylink_pcs_poll_start(struct phylink *pl)
> >   {
> > -	if (pl->pcs->poll && pl->cfg_link_an_mode == MLO_AN_INBAND)
> > +	if (pl->pcs && pl->pcs->poll && pl->cfg_link_an_mode == MLO_AN_INBAND)
> >   		mod_timer(&pl->link_poll, jiffies + HZ);
> >   }
> 
> Fixes the NULL pointer on my boards:
> Tested-by: Nicolas Ferre <nicolas.ferre@microchip.com> # on sam9x60ek

Thanks all, hopefully it'll get applied to net-next soon.

Sadly, this slipped through my testing, as the only platform I have
access to at the moment always supplies a PCS (mvneta based) so there's
no way my testing would ever have caught this. Sorry for the problems.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!

  reply	other threads:[~2022-06-30 14:50 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-29 19:33 [PATCH net-next] net: phylink: fix NULL pl->pcs dereference during phylink_pcs_poll_start Vladimir Oltean
2022-06-29 19:42 ` Russell King (Oracle)
2022-06-29 20:14   ` Gerhard Engleder
2022-06-30 11:41 ` Michael Walle
2022-06-30 13:46 ` Nicolas Ferre
2022-06-30 14:50   ` Russell King (Oracle) [this message]
2022-06-30 19:30 ` patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Yr24QzzcS1dMVtl0@shell.armlinux.org.uk \
    --to=linux@armlinux.org.uk \
    --cc=Claudiu.Beznea@microchip.com \
    --cc=Santiago.Esteban@microchip.com \
    --cc=andrew@lunn.ch \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=hkallweit1@gmail.com \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=nicolas.ferre@microchip.com \
    --cc=pabeni@redhat.com \
    --cc=vladimir.oltean@nxp.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.