From mboxrd@z Thu Jan 1 00:00:00 1970 From: Florian Fainelli Subject: Re: [PATCH net-next v2 1/3] net: phy: xgmiitorgmii: Check phy_driver ready before accessing Date: Tue, 26 Jun 2018 14:59:29 -0700 Message-ID: <6387da90-c0de-00d9-9744-d4386a316e79@gmail.com> References: <20180626175050.71165-1-brandon.maier@rockwellcollins.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Cc: andrew@lunn.ch, davem@davemloft.net, michal.simek@xilinx.com, clayton.shotwell@rockwellcollins.com, kristopher.cory@rockwellcollins.com, linux-kernel@vger.kernel.org To: Brandon Maier , netdev@vger.kernel.org Return-path: In-Reply-To: <20180626175050.71165-1-brandon.maier@rockwellcollins.com> Content-Language: en-US Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org On 06/26/2018 10:50 AM, Brandon Maier wrote: > Since a phy_device is added to the global mdio_bus list during > phy_device_register(), but a phy_device's phy_driver doesn't get > attached until phy_probe(). It's possible of_phy_find_device() in > xgmiitorgmii will return a valid phy with a NULL phy_driver. Leading to > a NULL pointer access during the memcpy(). > > Fixes this Oops: > > Unable to handle kernel NULL pointer dereference at virtual address 00000000 > pgd = c0004000 > [00000000] *pgd=00000000 > Internal error: Oops: 5 [#1] PREEMPT SMP ARM > Modules linked in: > CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.40 #1 > Hardware name: Xilinx Zynq Platform > task: ce4c8d00 task.stack: ce4ca000 > PC is at memcpy+0x48/0x330 > LR is at xgmiitorgmii_probe+0x90/0xe8 > pc : [] lr : [] psr: 20000013 > sp : ce4cbb54 ip : 00000000 fp : ce4cbb8c > r10: 00000000 r9 : 00000000 r8 : c0c49178 > r7 : 00000000 r6 : cdc14718 r5 : ce762800 r4 : cdc14710 > r3 : 00000000 r2 : 00000054 r1 : 00000000 r0 : cdc14718 > Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none > Control: 18c5387d Table: 0000404a DAC: 00000051 > Process swapper/0 (pid: 1, stack limit = 0xce4ca210) > ... > [] (memcpy) from [] (xgmiitorgmii_probe+0x90/0xe8) > [] (xgmiitorgmii_probe) from [] (mdio_probe+0x28/0x34) > [] (mdio_probe) from [] (driver_probe_device+0x254/0x414) > [] (driver_probe_device) from [] (__device_attach_driver+0xac/0x10c) > [] (__device_attach_driver) from [] (bus_for_each_drv+0x84/0xc8) > [] (bus_for_each_drv) from [] (__device_attach+0xd0/0x134) > [] (__device_attach) from [] (device_initial_probe+0x1c/0x20) > [] (device_initial_probe) from [] (bus_probe_device+0x98/0xa0) > [] (bus_probe_device) from [] (device_add+0x43c/0x5d0) > [] (device_add) from [] (mdio_device_register+0x34/0x80) > [] (mdio_device_register) from [] (of_mdiobus_register+0x170/0x30c) > [] (of_mdiobus_register) from [] (macb_probe+0x710/0xc00) > [] (macb_probe) from [] (platform_drv_probe+0x44/0x80) > [] (platform_drv_probe) from [] (driver_probe_device+0x254/0x414) > [] (driver_probe_device) from [] (__driver_attach+0x10c/0x118) > [] (__driver_attach) from [] (bus_for_each_dev+0x8c/0xd0) > [] (bus_for_each_dev) from [] (driver_attach+0x2c/0x30) > [] (driver_attach) from [] (bus_add_driver+0x50/0x260) > [] (bus_add_driver) from [] (driver_register+0x88/0x108) > [] (driver_register) from [] (__platform_driver_register+0x50/0x58) > [] (__platform_driver_register) from [] (macb_driver_init+0x24/0x28) > [] (macb_driver_init) from [] (do_one_initcall+0x60/0x1a4) > [] (do_one_initcall) from [] (kernel_init_freeable+0x15c/0x1f8) > [] (kernel_init_freeable) from [] (kernel_init+0x18/0x124) > [] (kernel_init) from [] (ret_from_fork+0x14/0x20) > Code: ba000002 f5d1f03c f5d1f05c f5d1f07c (e8b151f8) > ---[ end trace 3e4ec21905820a1f ]--- > > Signed-off-by: Brandon Maier Reviewed-by: Florian Fainelli -- Florian