From: Robert Hancock <hancock@sedsystems.ca>
To: netdev@vger.kernel.org
Cc: woojung.huh@microchip.com, UNGLinuxDriver@microchip.com
Subject: net-next: KSZ switch driver oops in ksz_mib_read_work
Date: Tue, 11 Jun 2019 11:57:13 -0600 [thread overview]
Message-ID: <6dc8cc46-6225-011c-68bc-c96a819fa00d@sedsystems.ca> (raw)
We are using an embedded platform with a KSZ9897 switch. I am getting
the oops below in ksz_mib_read_work when testing with net-next branch.
After adding in some debug output, the problem is in this code:
for (i = 0; i < dev->mib_port_cnt; i++) {
p = &dev->ports[i];
mib = &p->mib;
mutex_lock(&mib->cnt_mutex);
/* Only read MIB counters when the port is told to do.
* If not, read only dropped counters when link is not up.
*/
if (!p->read) {
const struct dsa_port *dp = dsa_to_port(dev->ds, i);
if (!netif_carrier_ok(dp->slave))
mib->cnt_ptr = dev->reg_mib_cnt;
}
The oops is happening on port index 3 (i.e. 4th port) which is not
connected on our platform and so has no entry in the device tree. For
that port, dp->slave is NULL and so netif_carrier_ok explodes.
If I change the code to skip the port entirely in the loop if dp->slave
is NULL it seems to fix the crash, but I'm not that familiar with this
code. Can someone confirm whether that is the proper fix?
[ 17.842829] Unable to handle kernel NULL pointer dereference at
virtual address 0000002c
[ 17.850983] pgd = (ptrval)
[ 17.853711] [0000002c] *pgd=00000000
[ 17.857317] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[ 17.862632] Modules linked in:
[ 17.865695] CPU: 1 PID: 21 Comm: kworker/1:1 Not tainted 5.2.0-rc3 #1
[ 17.872142] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[ 17.878688] Workqueue: events ksz_mib_read_work
[ 17.883227] PC is at ksz_mib_read_work+0x58/0x94
[ 17.887848] LR is at ksz_mib_read_work+0x38/0x94
[ 17.887852] pc : [<c04843dc>] lr : [<c04843bc>] psr: 60070113
[ 17.887857] sp : e8147f08 ip : e8148000 fp : ffffe000
[ 17.887860] r10: 00000000 r9 : e8aa7040 r8 : e867cc44
[ 17.887865] r7 : 00000c20 r6 : e8aa7120 r5 : 00000003 r4 : e867c958
[ 17.887868] r3 : 00000000 r2 : 00000000 r1 : 00000003 r0 : e8aa7040
[ 17.887879] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM
Segment none
[ 17.948224] Control: 10c5387d Table: 38d9404a DAC: 00000051
[ 17.948230] Process kworker/1:1 (pid: 21, stack limit = 0x(ptrval))
[ 17.948236] Stack: (0xe8147f08 to 0xe8148000)
[ 17.948245] 7f00: e8aa7120 e80a8080 eb7aef40
eb7b2000 00000000 e8aa7124
[ 17.948254] 7f20: 00000000 c013865c 00000008 c0b03d00 e80a8080
e80a8094 eb7aef40 00000008
[ 17.958073] systemd[1]: storage.mount: Unit is bound to inactive unit
dev-mmcblk1p2.device. Stopping, too.
[ 17.963306] 7f40: c0b03d00 eb7aef58 eb7aef40 c01393a0 ffffe000
c0b46b09 c084e464 00000000
[ 17.963314] 7f60: ffffe000 e8053140 e80530c0 00000000 e8146000
e80a8080 c013935c e80a1eac
[ 17.963322] 7f80: e805315c c013e78c 00000000 e80530c0 c013e648
00000000 00000000 00000000
[ 17.969893] random: systemd: uninitialized urandom read (16 bytes read)
[ 17.973942] 7fa0: 00000000 00000000 00000000 c01010e8 00000000
00000000 00000000 00000000
[ 17.973949] 7fc0: 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000
[ 17.973958] 7fe0: 00000000 00000000 00000000 00000000 00000013
00000000 00000000 00000000
[ 17.982246] random: systemd: uninitialized urandom read (16 bytes read)
[ 17.990329] [<c04843dc>] (ksz_mib_read_work) from [<c013865c>]
(process_one_work+0x17c/0x390)
[ 17.990345] [<c013865c>] (process_one_work) from [<c01393a0>]
(worker_thread+0x44/0x518)
[ 18.009394] random: systemd: uninitialized urandom read (16 bytes read)
[ 18.016344] [<c01393a0>] (worker_thread) from [<c013e78c>]
(kthread+0x144/0x14c)
[ 18.016358] [<c013e78c>] (kthread) from [<c01010e8>]
(ret_from_fork+0x14/0x2c)
[ 18.016362] Exception stack(0xe8147fb0 to 0xe8147ff8)
[ 18.016369] 7fa0: 00000000
00000000 00000000 00000000
[ 18.031159] 7fc0: 00000000 00000000 00000000 00000000 00000000
00000000 00000000 00000000
[ 18.031166] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[ 18.031176] Code: 1a000006 e51630e0 e0833405 e5933050 (e593302c)
[ 18.031279] ---[ end trace ca82392a6c2aa959 ]---
--
Robert Hancock
Senior Software Developer
SED Systems, a division of Calian Ltd.
Email: hancock@sedsystems.ca
next reply other threads:[~2019-06-11 17:57 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-11 17:57 Robert Hancock [this message]
2019-06-11 23:27 ` net-next: KSZ switch driver oops in ksz_mib_read_work Florian Fainelli
2019-06-12 14:09 ` Andrew Lunn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6dc8cc46-6225-011c-68bc-c96a819fa00d@sedsystems.ca \
--to=hancock@sedsystems.ca \
--cc=UNGLinuxDriver@microchip.com \
--cc=netdev@vger.kernel.org \
--cc=woojung.huh@microchip.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).