-
-
Notifications
You must be signed in to change notification settings - Fork 71
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
generic: backport at803x kernel panic fix
Backport at803x kernel panic fix merged upstream for kernel 6.1 and 6.6. Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
- Loading branch information
Showing
2 changed files
with
90 additions
and
0 deletions.
There are no files selected for viewing
45 changes: 45 additions & 0 deletions
45
.../generic/backport-6.1/718-v6.9-net-phy-qcom-at803x-fix-kernel-panic-with-at8031_pro.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| From 6a4aee277740d04ac0fd54cfa17cc28261932ddc Mon Sep 17 00:00:00 2001 | ||
| From: Christian Marangi <ansuelsmth@gmail.com> | ||
| Date: Mon, 25 Mar 2024 20:06:19 +0100 | ||
| Subject: [PATCH] net: phy: qcom: at803x: fix kernel panic with at8031_probe | ||
|
|
||
| On reworking and splitting the at803x driver, in splitting function of | ||
| at803x PHYs it was added a NULL dereference bug where priv is referenced | ||
| before it's actually allocated and then is tried to write to for the | ||
| is_1000basex and is_fiber variables in the case of at8031, writing on | ||
| the wrong address. | ||
|
|
||
| Fix this by correctly setting priv local variable only after | ||
| at803x_probe is called and actually allocates priv in the phydev struct. | ||
|
|
||
| Reported-by: William Wortel <wwortel@dorpstraat.com> | ||
| Cc: <stable@vger.kernel.org> | ||
| Fixes: 25d2ba94005f ("net: phy: at803x: move specific at8031 probe mode check to dedicated probe") | ||
| Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> | ||
| Reviewed-by: Andrew Lunn <andrew@lunn.ch> | ||
| Link: https://lore.kernel.org/r/20240325190621.2665-1-ansuelsmth@gmail.com | ||
| Signed-off-by: Paolo Abeni <pabeni@redhat.com> | ||
| --- | ||
| drivers/net/phy/qcom/at803x.c | 4 +++- | ||
| 1 file changed, 3 insertions(+), 1 deletion(-) | ||
|
|
||
| --- a/drivers/net/phy/qcom/at803x.c | ||
| +++ b/drivers/net/phy/qcom/at803x.c | ||
| @@ -797,7 +797,7 @@ static int at8031_parse_dt(struct phy_de | ||
|
|
||
| static int at8031_probe(struct phy_device *phydev) | ||
| { | ||
| - struct at803x_priv *priv = phydev->priv; | ||
| + struct at803x_priv *priv; | ||
| int mode_cfg; | ||
| int ccr; | ||
| int ret; | ||
| @@ -806,6 +806,8 @@ static int at8031_probe(struct phy_devic | ||
| if (ret) | ||
| return ret; | ||
|
|
||
| + priv = phydev->priv; | ||
| + | ||
| /* Only supported on AR8031/AR8033, the AR8030/AR8035 use strapping | ||
| * options. | ||
| */ |
45 changes: 45 additions & 0 deletions
45
.../generic/backport-6.6/718-v6.9-net-phy-qcom-at803x-fix-kernel-panic-with-at8031_pro.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,45 @@ | ||
| From 6a4aee277740d04ac0fd54cfa17cc28261932ddc Mon Sep 17 00:00:00 2001 | ||
| From: Christian Marangi <ansuelsmth@gmail.com> | ||
| Date: Mon, 25 Mar 2024 20:06:19 +0100 | ||
| Subject: [PATCH] net: phy: qcom: at803x: fix kernel panic with at8031_probe | ||
|
|
||
| On reworking and splitting the at803x driver, in splitting function of | ||
| at803x PHYs it was added a NULL dereference bug where priv is referenced | ||
| before it's actually allocated and then is tried to write to for the | ||
| is_1000basex and is_fiber variables in the case of at8031, writing on | ||
| the wrong address. | ||
|
|
||
| Fix this by correctly setting priv local variable only after | ||
| at803x_probe is called and actually allocates priv in the phydev struct. | ||
|
|
||
| Reported-by: William Wortel <wwortel@dorpstraat.com> | ||
| Cc: <stable@vger.kernel.org> | ||
| Fixes: 25d2ba94005f ("net: phy: at803x: move specific at8031 probe mode check to dedicated probe") | ||
| Signed-off-by: Christian Marangi <ansuelsmth@gmail.com> | ||
| Reviewed-by: Andrew Lunn <andrew@lunn.ch> | ||
| Link: https://lore.kernel.org/r/20240325190621.2665-1-ansuelsmth@gmail.com | ||
| Signed-off-by: Paolo Abeni <pabeni@redhat.com> | ||
| --- | ||
| drivers/net/phy/qcom/at803x.c | 4 +++- | ||
| 1 file changed, 3 insertions(+), 1 deletion(-) | ||
|
|
||
| --- a/drivers/net/phy/qcom/at803x.c | ||
| +++ b/drivers/net/phy/qcom/at803x.c | ||
| @@ -797,7 +797,7 @@ static int at8031_parse_dt(struct phy_de | ||
|
|
||
| static int at8031_probe(struct phy_device *phydev) | ||
| { | ||
| - struct at803x_priv *priv = phydev->priv; | ||
| + struct at803x_priv *priv; | ||
| int mode_cfg; | ||
| int ccr; | ||
| int ret; | ||
| @@ -806,6 +806,8 @@ static int at8031_probe(struct phy_devic | ||
| if (ret) | ||
| return ret; | ||
|
|
||
| + priv = phydev->priv; | ||
| + | ||
| /* Only supported on AR8031/AR8033, the AR8030/AR8035 use strapping | ||
| * options. | ||
| */ |