diff options
Diffstat (limited to 'target/linux/layerscape/patches-5.4/701-net-0338-net-dsa-felix-Fix-probing-allocation-and-cleanup-pat.patch')
| -rw-r--r-- | target/linux/layerscape/patches-5.4/701-net-0338-net-dsa-felix-Fix-probing-allocation-and-cleanup-pat.patch | 123 |
1 files changed, 123 insertions, 0 deletions
diff --git a/target/linux/layerscape/patches-5.4/701-net-0338-net-dsa-felix-Fix-probing-allocation-and-cleanup-pat.patch b/target/linux/layerscape/patches-5.4/701-net-0338-net-dsa-felix-Fix-probing-allocation-and-cleanup-pat.patch new file mode 100644 index 0000000000..3e99861d16 --- /dev/null +++ b/target/linux/layerscape/patches-5.4/701-net-0338-net-dsa-felix-Fix-probing-allocation-and-cleanup-pat.patch @@ -0,0 +1,123 @@ +From 5ae4c4ac2d992afcf4087e5f33ad7e5f7d073fbf Mon Sep 17 00:00:00 2001 +From: Claudiu Manoil <claudiu.manoil@nxp.com> +Date: Wed, 4 Dec 2019 14:36:09 +0200 +Subject: [PATCH] net: dsa: felix: Fix probing allocation and cleanup path + +dsa_switch_alloc() uses managed (devm_alloc) allocation +to alloc 'ds'. kfree()-ing 'ds' results in memory corruption. +kfree(ds) seems harmless on the error path, however for this +particular device, dsa_register_swtich() deffers probing to +allow the enetc driver to probe the master port first. +This results in kfree(ds) being called during the first +probing attempt of felix, followed by a NULL poiter access +crash during enetc driver probing (when accessing its net_device). + +This patch fixes following crash (triggerred in the enetc driver by +the probing routine of the felix driver): + +[ 3.502254] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 +[ 3.511073] Mem abort info: +[ 3.513874] ESR = 0x96000044 +[ 3.516936] EC = 0x25: DABT (current EL), IL = 32 bits +[ 3.522266] SET = 0, FnV = 0 +[ 3.525327] EA = 0, S1PTW = 0 +[ 3.528476] Data abort info: +[ 3.531359] ISV = 0, ISS = 0x00000044 +[ 3.535205] CM = 0, WnR = 1 +[ 3.538182] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020f612d000 +[ 3.544645] [0000000000000000] pgd=0000000000000000 +[ 3.549542] Internal error: Oops: 96000044 [#1] PREEMPT SMP +[ 3.555128] Modules linked in: +[ 3.558189] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.0-03552-gfa6e1cd69f80 #1 +[ 3.565781] Hardware name: LS1028A RDB Board (DT) +[ 3.570496] pstate: a0000005 (NzCv daif -PAN -UAO) +[ 3.575303] pc : enetc_pf_probe+0x784/0xba8 +[ 3.579495] lr : enetc_pf_probe+0x6e8/0xba8 +[ 3.583686] sp : ffff80001002ba90 +[ 3.587005] x29: ffff80001002ba90 x28: ffff002076130c08 +[ 3.592331] x27: 0000000000000002 x26: ffff002076130c80 +[ 3.597657] x25: ffff002076130c00 x24: ffff002076130c80 +[ 3.602982] x23: ffffb3f2ab0ec000 x22: ffff0020760d7840 +[ 3.608307] x21: ffff0020760d7000 x20: ffff002076130c00 +[ 3.613632] x19: ffff800010850000 x18: ffffffffffffffff +[ 3.618957] x17: 000000007dee1586 x16: 00000000cb746ba4 +[ 3.624282] x15: ffffb3f2abce9908 x14: 0000000000000000 +[ 3.629608] x13: 0000000000000101 x12: 0000000000010000 +[ 3.634933] x11: 00000000ffffffff x10: ffff4c2dd0136000 +[ 3.640257] x9 : 0000000000000000 x8 : ffff002076122000 +[ 3.645582] x7 : 0000000000000000 x6 : 000000000000003f +[ 3.650908] x5 : 0000000000000040 x4 : 0000000000000001 +[ 3.656234] x3 : ffff800010850000 x2 : ffffb3f2ab0ed868 +[ 3.661560] x1 : 0000000000000000 x0 : 00000000051ca556 +[ 3.666886] Call trace: +[ 3.669333] enetc_pf_probe+0x784/0xba8 +[ 3.673178] local_pci_probe+0x3c/0xa0 +[ 3.676935] pci_device_probe+0x128/0x1c0 +[ 3.680954] really_probe+0x108/0x348 +[ 3.684623] driver_probe_device+0x58/0x100 +[ 3.688815] device_driver_attach+0x6c/0x90 +[ 3.693006] __driver_attach+0x84/0xc8 +[ 3.696762] bus_for_each_dev+0x74/0xc8 +[ 3.700605] driver_attach+0x20/0x28 +[ 3.704186] bus_add_driver+0x148/0x1f0 +[ 3.708029] driver_register+0x60/0x110 +[ 3.711872] __pci_register_driver+0x40/0x48 +[ 3.716153] enetc_pf_driver_init+0x20/0x28 +[ 3.720346] do_one_initcall+0x5c/0x1b0 +[ 3.724189] kernel_init_freeable+0x1a4/0x24c +[ 3.728557] kernel_init+0x10/0x108 +[ 3.732052] ret_from_fork+0x10/0x18 +[ 3.735635] Code: f9400680 f9417ea1 91020000 b9400000 (b9000020) +[ 3.741749] ---[ end trace c8ab43e3d33fed3f ]--- +[ 3.746396] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b +[ 3.748522] ata1: SATA link down (SStatus 0 SControl 300) +[ 3.754077] SMP: stopping secondary CPUs +[ 3.754082] Kernel Offset: 0x33f299c00000 from 0xffff800010000000 +[ 3.754083] PHYS_OFFSET: 0xfffff019c0000000 +[ 3.754086] CPU features: 0x0002,21806008 +[ 3.754088] Memory Limit: none +[ 3.780794] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- + +As a result of the fix, struct felix allocation also needs to +be converted to managed allocation (devm_alloc). + +Fixes: bb849431a970 ("net: dsa: ocelot: alloc memory for dsa switch instance") + +Signed-off-by: Claudiu Manoil <claudiu.manoil@nxp.com> +--- + drivers/net/dsa/ocelot/felix.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +--- a/drivers/net/dsa/ocelot/felix.c ++++ b/drivers/net/dsa/ocelot/felix.c +@@ -530,7 +530,7 @@ static int felix_pci_probe(struct pci_de + } + } + +- felix = kzalloc(sizeof(struct felix), GFP_KERNEL); ++ felix = devm_kzalloc(&pdev->dev, sizeof(*felix), GFP_KERNEL); + if (!felix) { + err = -ENOMEM; + dev_err(&pdev->dev, "Failed to allocate driver memory\n"); +@@ -577,11 +577,9 @@ static int felix_pci_probe(struct pci_de + return 0; + + err_register_ds: +- kfree(ds); + err_alloc_ds: + err_alloc_irq: + err_alloc_felix: +- kfree(felix); + err_dma: + pci_disable_device(pdev); + err_pci_enable: +@@ -596,9 +594,6 @@ static void felix_pci_remove(struct pci_ + + dsa_unregister_switch(felix->ds); + +- kfree(felix->ds); +- kfree(felix); +- + pci_disable_device(pdev); + } + |