From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Brandon Maier , "David S . Miller" , Sasha Levin Subject: [PATCH AUTOSEL 4.14 62/87] net: phy: xgmiitorgmii: Check phy_driver ready before accessing Date: Mon, 17 Sep 2018 03:03:04 +0000 Message-ID: <20180917030220.245686-62-alexander.levin@microsoft.com> References: <20180917030220.245686-1-alexander.levin@microsoft.com> In-Reply-To: <20180917030220.245686-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Brandon Maier [ Upstream commit ab4e6ee578e88a659938db8fbf33720bc048d29c ] Since a phy_device is added to the global mdio_bus list during phy_device_register(), but a phy_device's phy_driver doesn't get attached until phy_probe(). It's possible of_phy_find_device() in xgmiitorgmii will return a valid phy with a NULL phy_driver. Leading to a NULL pointer access during the memcpy(). Fixes this Oops: Unable to handle kernel NULL pointer dereference at virtual address 0000000= 0 pgd =3D c0004000 [00000000] *pgd=3D00000000 Internal error: Oops: 5 [#1] PREEMPT SMP ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.14.40 #1 Hardware name: Xilinx Zynq Platform task: ce4c8d00 task.stack: ce4ca000 PC is at memcpy+0x48/0x330 LR is at xgmiitorgmii_probe+0x90/0xe8 pc : [] lr : [] psr: 20000013 sp : ce4cbb54 ip : 00000000 fp : ce4cbb8c r10: 00000000 r9 : 00000000 r8 : c0c49178 r7 : 00000000 r6 : cdc14718 r5 : ce762800 r4 : cdc14710 r3 : 00000000 r2 : 00000054 r1 : 00000000 r0 : cdc14718 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 18c5387d Table: 0000404a DAC: 00000051 Process swapper/0 (pid: 1, stack limit =3D 0xce4ca210) ... [] (memcpy) from [] (xgmiitorgmii_probe+0x90/0xe8) [] (xgmiitorgmii_probe) from [] (mdio_probe+0x28/0x34) [] (mdio_probe) from [] (driver_probe_device+0x254/0x41= 4) [] (driver_probe_device) from [] (__device_attach_drive= r+0xac/0x10c) [] (__device_attach_driver) from [] (bus_for_each_drv+0= x84/0xc8) [] (bus_for_each_drv) from [] (__device_attach+0xd0/0x1= 34) [] (__device_attach) from [] (device_initial_probe+0x1c= /0x20) [] (device_initial_probe) from [] (bus_probe_device+0x9= 8/0xa0) [] (bus_probe_device) from [] (device_add+0x43c/0x5d0) [] (device_add) from [] (mdio_device_register+0x34/0x80= ) [] (mdio_device_register) from [] (of_mdiobus_register+= 0x170/0x30c) [] (of_mdiobus_register) from [] (macb_probe+0x710/0xc0= 0) [] (macb_probe) from [] (platform_drv_probe+0x44/0x80) [] (platform_drv_probe) from [] (driver_probe_device+0x= 254/0x414) [] (driver_probe_device) from [] (__driver_attach+0x10c= /0x118) [] (__driver_attach) from [] (bus_for_each_dev+0x8c/0xd= 0) [] (bus_for_each_dev) from [] (driver_attach+0x2c/0x30) [] (driver_attach) from [] (bus_add_driver+0x50/0x260) [] (bus_add_driver) from [] (driver_register+0x88/0x108= ) [] (driver_register) from [] (__platform_driver_registe= r+0x50/0x58) [] (__platform_driver_register) from [] (macb_driver_in= it+0x24/0x28) [] (macb_driver_init) from [] (do_one_initcall+0x60/0x1= a4) [] (do_one_initcall) from [] (kernel_init_freeable+0x15= c/0x1f8) [] (kernel_init_freeable) from [] (kernel_init+0x18/0x1= 24) [] (kernel_init) from [] (ret_from_fork+0x14/0x20) Code: ba000002 f5d1f03c f5d1f05c f5d1f07c (e8b151f8) ---[ end trace 3e4ec21905820a1f ]--- Signed-off-by: Brandon Maier Reviewed-by: Andrew Lunn Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/phy/xilinx_gmii2rgmii.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_g= mii2rgmii.c index 449b31319010..7a14e8170e82 100644 --- a/drivers/net/phy/xilinx_gmii2rgmii.c +++ b/drivers/net/phy/xilinx_gmii2rgmii.c @@ -84,6 +84,11 @@ static int xgmiitorgmii_probe(struct mdio_device *mdiode= v) return -EPROBE_DEFER; } =20 + if (!priv->phy_dev->drv) { + dev_info(dev, "Attached phy not ready\n"); + return -EPROBE_DEFER; + } + priv->addr =3D mdiodev->addr; priv->phy_drv =3D priv->phy_dev->drv; memcpy(&priv->conv_phy_drv, priv->phy_dev->drv, --=20 2.17.1