From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Geert Uytterhoeven <geert+renesas@glider.be>,
David Daney <ddaney.cavm@gmail.com>,
Florian Fainelli <f.fainelli@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.12 32/52] Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()"
Date: Mon, 18 Sep 2017 11:11:26 +0200 [thread overview]
Message-ID: <20170918091021.417544442@linuxfoundation.org> (raw)
In-Reply-To: <20170918091016.620101134@linuxfoundation.org>
4.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
[ Upstream commit ebc8254aeae34226d0bc8fda309fd9790d4dccfe ]
This reverts commit 7ad813f208533cebfcc32d3d7474dc1677d1b09a ("net: phy:
Correctly process PHY_HALTED in phy_stop_machine()") because it is
creating the possibility for a NULL pointer dereference.
David Daney provide the following call trace and diagram of events:
When ndo_stop() is called we call:
phy_disconnect()
+---> phy_stop_interrupts() implies: phydev->irq = PHY_POLL;
+---> phy_stop_machine()
| +---> phy_state_machine()
| +----> queue_delayed_work(): Work queued.
+--->phy_detach() implies: phydev->attached_dev = NULL;
Now at a later time the queued work does:
phy_state_machine()
+---->netif_carrier_off(phydev->attached_dev): Oh no! It is NULL:
CPU 12 Unable to handle kernel paging request at virtual address
0000000000000048, epc == ffffffff80de37ec, ra == ffffffff80c7c
Oops[#1]:
CPU: 12 PID: 1502 Comm: kworker/12:1 Not tainted 4.9.43-Cavium-Octeon+ #1
Workqueue: events_power_efficient phy_state_machine
task: 80000004021ed100 task.stack: 8000000409d70000
$ 0 : 0000000000000000 ffffffff84720060 0000000000000048 0000000000000004
$ 4 : 0000000000000000 0000000000000001 0000000000000004 0000000000000000
$ 8 : 0000000000000000 0000000000000000 00000000ffff98f3 0000000000000000
$12 : 8000000409d73fe0 0000000000009c00 ffffffff846547c8 000000000000af3b
$16 : 80000004096bab68 80000004096babd0 0000000000000000 80000004096ba800
$20 : 0000000000000000 0000000000000000 ffffffff81090000 0000000000000008
$24 : 0000000000000061 ffffffff808637b0
$28 : 8000000409d70000 8000000409d73cf0 80000000271bd300 ffffffff80c7804c
Hi : 000000000000002a
Lo : 000000000000003f
epc : ffffffff80de37ec netif_carrier_off+0xc/0x58
ra : ffffffff80c7804c phy_state_machine+0x48c/0x4f8
Status: 14009ce3 KX SX UX KERNEL EXL IE
Cause : 00800008 (ExcCode 02)
BadVA : 0000000000000048
PrId : 000d9501 (Cavium Octeon III)
Modules linked in:
Process kworker/12:1 (pid: 1502, threadinfo=8000000409d70000,
task=80000004021ed100, tls=0000000000000000)
Stack : 8000000409a54000 80000004096bab68 80000000271bd300 80000000271c1e00
0000000000000000 ffffffff808a1708 8000000409a54000 80000000271bd300
80000000271bd320 8000000409a54030 ffffffff80ff0f00 0000000000000001
ffffffff81090000 ffffffff808a1ac0 8000000402182080 ffffffff84650000
8000000402182080 ffffffff84650000 ffffffff80ff0000 8000000409a54000
ffffffff808a1970 0000000000000000 80000004099e8000 8000000402099240
0000000000000000 ffffffff808a8598 0000000000000000 8000000408eeeb00
8000000409a54000 00000000810a1d00 0000000000000000 8000000409d73de8
8000000409d73de8 0000000000000088 000000000c009c00 8000000409d73e08
8000000409d73e08 8000000402182080 ffffffff808a84d0 8000000402182080
...
Call Trace:
[<ffffffff80de37ec>] netif_carrier_off+0xc/0x58
[<ffffffff80c7804c>] phy_state_machine+0x48c/0x4f8
[<ffffffff808a1708>] process_one_work+0x158/0x368
[<ffffffff808a1ac0>] worker_thread+0x150/0x4c0
[<ffffffff808a8598>] kthread+0xc8/0xe0
[<ffffffff808617f0>] ret_from_kernel_thread+0x14/0x1c
The original motivation for this change originated from Marc Gonzales
indicating that his network driver did not have its adjust_link callback
executing with phydev->link = 0 while he was expecting it.
PHYLIB has never made any such guarantees ever because phy_stop() merely just
tells the workqueue to move into PHY_HALTED state which will happen
asynchronously.
Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reported-by: David Daney <ddaney.cavm@gmail.com>
Fixes: 7ad813f20853 ("net: phy: Correctly process PHY_HALTED in phy_stop_machine()")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/phy.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -749,9 +749,6 @@ void phy_stop_machine(struct phy_device
if (phydev->state > PHY_UP && phydev->state != PHY_HALTED)
phydev->state = PHY_UP;
mutex_unlock(&phydev->lock);
-
- /* Now we can run the state machine synchronously */
- phy_state_machine(&phydev->state_queue.work);
}
/**
next prev parent reply other threads:[~2017-09-18 9:13 UTC|newest]
Thread overview: 58+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-18 9:10 [PATCH 4.12 00/52] 4.12.14-stable review Greg Kroah-Hartman
2017-09-18 9:10 ` [PATCH 4.12 01/52] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() Greg Kroah-Hartman
2017-09-18 9:10 ` [PATCH 4.12 02/52] ipv6: add rcu grace period before freeing fib6_node Greg Kroah-Hartman
2017-09-18 9:10 ` [PATCH 4.12 03/52] ipv6: fix sparse warning on rt6i_node Greg Kroah-Hartman
2017-09-18 9:10 ` [PATCH 4.12 04/52] macsec: add genl family module alias Greg Kroah-Hartman
2017-09-18 9:10 ` [PATCH 4.12 05/52] udp: on peeking bad csum, drop packets even if not at head Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 06/52] bpf: fix map value attribute for hash of maps Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 07/52] fsl/man: Inherit parent device and of_node Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 08/52] sctp: Avoid out-of-bounds reads from address storage Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 09/52] qlge: avoid memcpy buffer overflow Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 10/52] tipc: Fix tipc_sk_reinit handling of -EAGAIN Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 11/52] net: systemport: Be drop monitor friendly Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 12/52] net: bcmgenet: " Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 13/52] net: systemport: Free DMA coherent descriptors on errors Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 14/52] netvsc: fix deadlock betwen link status and removal Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 15/52] udp6: set rx_dst_cookie on rx_dst updates Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 16/52] net: mvpp2: fix the mac address used when using PPv2.2 Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 17/52] cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox() Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 18/52] ipv6: set dst.obsolete when a cached route has expired Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 19/52] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 20/52] packet: Dont write vnet header beyond end of buffer Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 21/52] kcm: do not attach PF_KCM sockets to avoid deadlock Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 22/52] net: dsa: bcm_sf2: Fix number of CFP entries for BCM7278 Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 23/52] net/mlx5e: Check for qos capability in dcbnl_initialize Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 24/52] net/mlx5e: Fix DCB_CAP_ATTR_DCBX capability for DCBNL getcap Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 25/52] net/mlx5: Fix arm SRQ command for ISSI version 0 Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 26/52] net/mlx5e: Fix dangling page pointer on DMA mapping error Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 27/52] net/mlx5e: Dont override user RSS upon set channels Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 28/52] net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 29/52] net/mlx5: E-Switch, Unload the representors in the correct order Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 30/52] net/mlx5e: Fix inline header size for small packets Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 31/52] net/mlx5e: Fix CQ moderation mode not set properly Greg Kroah-Hartman
2017-09-18 9:11 ` Greg Kroah-Hartman [this message]
2017-09-18 9:11 ` [PATCH 4.12 33/52] net: fec: Allow reception of frames bigger than 1522 bytes Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 34/52] mlxsw: spectrum: Forbid linking to devices that have uppers Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 35/52] bridge: switchdev: Clear forward mark when transmitting packet Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 36/52] Revert "net: use lib/percpu_counter API for fragmentation mem accounting" Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 37/52] Revert "net: fix percpu memory leaks" Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 38/52] gianfar: Fix Tx flow control deactivation Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 39/52] vhost_net: correctly check tx avail during rx busy polling Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 40/52] ip6_gre: update mtu properly in ip6gre_err Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 41/52] ipv6: fix memory leak with multiple tables during netns destruction Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 42/52] ipv6: fix typo in fib6_net_exit() Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 43/52] sctp: fix missing wake ups in some situations Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 44/52] f2fs: let fill_super handle roll-forward errors Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 45/52] f2fs: check hot_data for roll-forward recovery Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 46/52] x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 47/52] x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 48/52] x86/switch_to/64: Rewrite FS/GS switching yet again to fix AMD CPUs Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 49/52] fuse: allow server to run in different pid_ns Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 50/52] idr: remove WARN_ON_ONCE() when trying to replace negative ID Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 51/52] md/raid1/10: reset bio allocated from mempool Greg Kroah-Hartman
2017-09-18 9:11 ` [PATCH 4.12 52/52] md/raid5: release/flush io in raid5_do_work() Greg Kroah-Hartman
2017-09-18 14:22 ` [PATCH 4.12 00/52] 4.12.14-stable review Sudip Mukherjee
2017-09-19 6:34 ` Greg Kroah-Hartman
2017-09-20 12:15 ` Sudip Mukherjee
2017-09-18 19:28 ` Guenter Roeck
2017-09-18 20:14 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170918091021.417544442@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=ddaney.cavm@gmail.com \
--cc=f.fainelli@gmail.com \
--cc=geert+renesas@glider.be \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).