[PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[Fabio Estevam]

From: Fabio Estevam <festevam@denx.de>

Since commit f1131b9c23fb ("net: phy: micrel: use
kszphy_suspend()/kszphy_resume for irq aware devices") the following
NULL pointer dereference is observed on a board with KSZ8061:

 # udhcpc -i eth0
udhcpc: started, v1.35.0
8<--- cut here ---
Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = f73cef4e
[00000008] *pgd=00000000
Internal error: Oops: 5 [#1] SMP ARM
Modules linked in:
CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94
Hardware name: Freescale i.MX6 SoloX (Device Tree)
PC is at kszphy_config_reset+0x10/0x114
LR is at kszphy_resume+0x24/0x64
...

The KSZ8061 phy_driver structure does not have the .probe/..driver_data
fields, which means that priv is not allocated.

This causes the NULL pointer dereference inside kszphy_config_reset().

Fix the problem by using the generic suspend/resume functions as before.

Another alternative would be to provide the .probe and .driver_data
information into the structure, but to be on the safe side, let's
just restore Ethernet functionality by using the generic suspend/resume.

Cc: stable@vger.kernel.org
Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices")
Signed-off-by: Fabio Estevam <festevam@denx.de>
---
Changes since v1:
- Explained why enphy_suspend/resume solution is preferred (Andrew).

 drivers/net/phy/micrel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 685a0ab5453c..11cd073630e5 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -3021,8 +3021,8 @@ static struct phy_driver ksphy_driver[] = {
 	.config_init	= ksz8061_config_init,
 	.config_intr	= kszphy_config_intr,
 	.handle_interrupt = kszphy_handle_interrupt,
-	.suspend	= kszphy_suspend,
-	.resume		= kszphy_resume,
+	.suspend	= genphy_suspend,
+	.resume		= genphy_resume,
 }, {
 	.phy_id		= PHY_ID_KSZ9021,
 	.phy_id_mask	= 0x000ffffe,
-- 
2.25.1

[PATCH net v2 2/2] net: phy: micrel: Pass .probe for KS8737

[Fabio Estevam]

From: Fabio Estevam <festevam@denx.de>

Since commit f1131b9c23fb ("net: phy: micrel: use
kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/
resume hooks are used.

These functions require the probe function to be called so that
priv can be allocated.

Otherwise, a NULL pointer dereference happens inside
kszphy_config_reset().

Cc: stable@vger.kernel.org
Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices")
Reported-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Fabio Estevam <festevam@denx.de>
---
Changes since v1:
- Newly introduced. This was noticed by Andrew.

 drivers/net/phy/micrel.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 11cd073630e5..a06661c07ca8 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -2896,6 +2896,7 @@ static struct phy_driver ksphy_driver[] = {
 	.name		= "Micrel KS8737",
 	/* PHY_BASIC_FEATURES */
 	.driver_data	= &ks8737_type,
+	.probe		= kszphy_probe,
 	.config_init	= kszphy_config_init,
 	.config_intr	= kszphy_config_intr,
 	.handle_interrupt = kszphy_handle_interrupt,
-- 
2.25.1

Re: [PATCH net v2 2/2] net: phy: micrel: Pass .probe for KS8737

[Andrew Lunn]

On Wed, May 04, 2022 at 11:31:04AM -0300, Fabio Estevam wrote:
> From: Fabio Estevam <festevam@denx.de>
> 
> Since commit f1131b9c23fb ("net: phy: micrel: use
> kszphy_suspend()/kszphy_resume for irq aware devices") the kszphy_suspend/
> resume hooks are used.
> 
> These functions require the probe function to be called so that
> priv can be allocated.
> 
> Otherwise, a NULL pointer dereference happens inside
> kszphy_config_reset().
> 
> Cc: stable@vger.kernel.org
> Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices")
> Reported-by: Andrew Lunn <andrew@lunn.ch>
> Signed-off-by: Fabio Estevam <festevam@denx.de>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[Fabio Estevam]

Hi Andrew,

On Wed, May 4, 2022 at 11:31 AM Fabio Estevam <festevam@gmail.com> wrote:
>
> From: Fabio Estevam <festevam@denx.de>
>
> Since commit f1131b9c23fb ("net: phy: micrel: use
> kszphy_suspend()/kszphy_resume for irq aware devices") the following
> NULL pointer dereference is observed on a board with KSZ8061:
>
>  # udhcpc -i eth0
> udhcpc: started, v1.35.0
> 8<--- cut here ---
> Unable to handle kernel NULL pointer dereference at virtual address 00000008
> pgd = f73cef4e
> [00000008] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in:
> CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94
> Hardware name: Freescale i.MX6 SoloX (Device Tree)
> PC is at kszphy_config_reset+0x10/0x114
> LR is at kszphy_resume+0x24/0x64
> ...
>
> The KSZ8061 phy_driver structure does not have the .probe/..driver_data
> fields, which means that priv is not allocated.
>
> This causes the NULL pointer dereference inside kszphy_config_reset().
>
> Fix the problem by using the generic suspend/resume functions as before.
>
> Another alternative would be to provide the .probe and .driver_data
> information into the structure, but to be on the safe side, let's
> just restore Ethernet functionality by using the generic suspend/resume.
>
> Cc: stable@vger.kernel.org
> Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices")
> Signed-off-by: Fabio Estevam <festevam@denx.de>
> ---
> Changes since v1:
> - Explained why enphy_suspend/resume solution is preferred (Andrew).

If this series gets applied, I plan to submit two patches targeting net-next to:

1. Allow .probe to be called without .data_driver being passed
2. Convert KSZ8061 to use .probe and kszphy_suspend/resume

Re: [PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[Andrew Lunn]

> If this series gets applied, I plan to submit two patches targeting net-next to:
> 
> 1. Allow .probe to be called without .data_driver being passed
> 2. Convert KSZ8061 to use .probe and kszphy_suspend/resume

Great.

Please wait at least a week so that net gets merged into net-next, so
there are no merge conflicts.

Thanks
	Andrew

Re: [PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[Andrew Lunn]

On Wed, May 04, 2022 at 11:31:03AM -0300, Fabio Estevam wrote:
> From: Fabio Estevam <festevam@denx.de>
> 
> Since commit f1131b9c23fb ("net: phy: micrel: use
> kszphy_suspend()/kszphy_resume for irq aware devices") the following
> NULL pointer dereference is observed on a board with KSZ8061:
> 
>  # udhcpc -i eth0
> udhcpc: started, v1.35.0
> 8<--- cut here ---
> Unable to handle kernel NULL pointer dereference at virtual address 00000008
> pgd = f73cef4e
> [00000008] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in:
> CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94
> Hardware name: Freescale i.MX6 SoloX (Device Tree)
> PC is at kszphy_config_reset+0x10/0x114
> LR is at kszphy_resume+0x24/0x64
> ...
> 
> The KSZ8061 phy_driver structure does not have the .probe/..driver_data
> fields, which means that priv is not allocated.
> 
> This causes the NULL pointer dereference inside kszphy_config_reset().
> 
> Fix the problem by using the generic suspend/resume functions as before.
> 
> Another alternative would be to provide the .probe and .driver_data
> information into the structure, but to be on the safe side, let's
> just restore Ethernet functionality by using the generic suspend/resume.
> 
> Cc: stable@vger.kernel.org
> Fixes: f1131b9c23fb ("net: phy: micrel: use kszphy_suspend()/kszphy_resume for irq aware devices")
> Signed-off-by: Fabio Estevam <festevam@denx.de>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

Re: [PATCH net v2 1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel.org>:

On Wed,  4 May 2022 11:31:03 -0300 you wrote:
> From: Fabio Estevam <festevam@denx.de>
> 
> Since commit f1131b9c23fb ("net: phy: micrel: use
> kszphy_suspend()/kszphy_resume for irq aware devices") the following
> NULL pointer dereference is observed on a board with KSZ8061:
> 
>  # udhcpc -i eth0
> udhcpc: started, v1.35.0
> 8<--- cut here ---
> Unable to handle kernel NULL pointer dereference at virtual address 00000008
> pgd = f73cef4e
> [00000008] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in:
> CPU: 0 PID: 196 Comm: ifconfig Not tainted 5.15.37-dirty #94
> Hardware name: Freescale i.MX6 SoloX (Device Tree)
> PC is at kszphy_config_reset+0x10/0x114
> LR is at kszphy_resume+0x24/0x64
> ...
> 
> [...]

Here is the summary with links:
  - [net,v2,1/2] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061
    https://git.kernel.org/netdev/net/c/e333eed63a09
  - [net,v2,2/2] net: phy: micrel: Pass .probe for KS8737
    https://git.kernel.org/netdev/net/c/15f03ffe4bb9

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html