[PATCHv3] phy: fix crash in fixed_phy_add()

[PATCHv3] phy: fix crash in fixed_phy_add()

[Rabin Vincent]

From: Rabin Vincent <rabinv@axis.com>

Since e7f4dc3536a ("mdio: Move allocation of interrupts into core"),
platforms which call fixed_phy_add() before fixed_mdio_bus_init() is
called (for example, because the platform code and the fixed_phy driver
use the same initcall level) crash in fixed_phy_add() since the
->mii_bus is not allocated.

Also since e7f4dc3536a, these interrupts are initalized to polling by
default.  The few (old) platforms which directly use fixed_phy_add()
from their platform code all pass PHY_POLL for the irq argument, so we
can keep these platforms not crashing by simply not attempting to set
the irq if PHY_POLL is passed.

Also, even if problems have not been reported on more modern platforms
which used fixed_phy_register() from drivers' probe functions, we return
-EPROBE_DEFER if the MDIO bus is not yet registered so that the probe is
retried later.

Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core")
Signed-off-by: Rabin Vincent <rabinv@axis.com>
---
v3: One more suggestion from Andrew: check mii bus state

 drivers/net/phy/fixed_phy.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/phy/fixed_phy.c b/drivers/net/phy/fixed_phy.c
index fc07a88..e7dcda6 100644
--- a/drivers/net/phy/fixed_phy.c
+++ b/drivers/net/phy/fixed_phy.c
@@ -255,7 +255,8 @@ int fixed_phy_add(unsigned int irq, int phy_addr,
 
 	memset(fp->regs, 0xFF,  sizeof(fp->regs[0]) * MII_REGS_NUM);
 
-	fmb->mii_bus->irq[phy_addr] = irq;
+	if (irq != PHY_POLL)
+		fmb->mii_bus->irq[phy_addr] = irq;
 
 	fp->addr = phy_addr;
 	fp->status = *status;
@@ -314,6 +315,9 @@ struct phy_device *fixed_phy_register(unsigned int irq,
 	int phy_addr;
 	int ret;
 
+	if (!fmb->mii_bus || fmb->mii_bus->state != MDIOBUS_REGISTERED)
+		return ERR_PTR(-EPROBE_DEFER);
+
 	/* Get the next available PHY address, up to PHY_MAX_ADDR */
 	spin_lock(&phy_fixed_addr_lock);
 	if (phy_fixed_addr == PHY_MAX_ADDR) {
-- 
2.1.4

Re: [PATCHv3] phy: fix crash in fixed_phy_add()

[Andrew Lunn]

On Wed, May 18, 2016 at 12:47:31PM +0200, Rabin Vincent wrote:
> From: Rabin Vincent <rabinv@axis.com>
> 
> Since e7f4dc3536a ("mdio: Move allocation of interrupts into core"),
> platforms which call fixed_phy_add() before fixed_mdio_bus_init() is
> called (for example, because the platform code and the fixed_phy driver
> use the same initcall level) crash in fixed_phy_add() since the
> ->mii_bus is not allocated.
> 
> Also since e7f4dc3536a, these interrupts are initalized to polling by
> default.  The few (old) platforms which directly use fixed_phy_add()
> from their platform code all pass PHY_POLL for the irq argument, so we
> can keep these platforms not crashing by simply not attempting to set
> the irq if PHY_POLL is passed.
> 
> Also, even if problems have not been reported on more modern platforms
> which used fixed_phy_register() from drivers' probe functions, we return
> -EPROBE_DEFER if the MDIO bus is not yet registered so that the probe is
> retried later.
> 
> Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core")
> Signed-off-by: Rabin Vincent <rabinv@axis.com>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

Thanks
	Andrew

Re: [PATCHv3] phy: fix crash in fixed_phy_add()

[David Miller]

From: Rabin Vincent <rabin.vincent@axis.com>
Date: Wed, 18 May 2016 12:47:31 +0200

> From: Rabin Vincent <rabinv@axis.com>
> 
> Since e7f4dc3536a ("mdio: Move allocation of interrupts into core"),
> platforms which call fixed_phy_add() before fixed_mdio_bus_init() is
> called (for example, because the platform code and the fixed_phy driver
> use the same initcall level) crash in fixed_phy_add() since the
> ->mii_bus is not allocated.
> 
> Also since e7f4dc3536a, these interrupts are initalized to polling by
> default.  The few (old) platforms which directly use fixed_phy_add()
> from their platform code all pass PHY_POLL for the irq argument, so we
> can keep these platforms not crashing by simply not attempting to set
> the irq if PHY_POLL is passed.
> 
> Also, even if problems have not been reported on more modern platforms
> which used fixed_phy_register() from drivers' probe functions, we return
> -EPROBE_DEFER if the MDIO bus is not yet registered so that the probe is
> retried later.
> 
> Fixes: e7f4dc3536a400 ("mdio: Move allocation of interrupts into core")
> Signed-off-by: Rabin Vincent <rabinv@axis.com>
> ---
> v3: One more suggestion from Andrew: check mii bus state

Applied, thanks.