netdev - Re: [PATCH] phy: remove irq param to fix crash in fixed_phy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 16 May 2016 14:29:03 +0200
From:	Andrew Lunn <andrew@...n.ch>
To:	Rabin Vincent <rabin.vincent@...s.com>
Cc:	"David S. Miller" <davem@...emloft.net>, f.fainelli@...il.com,
	netdev@...r.kernel.org, linux-m68k@...ts.linux-m68k.org,
	linux-mips@...ux-mips.org, devicetree@...r.kernel.org,
	Rabin Vincent <rabinv@...s.com>
Subject: Re: [PATCH] phy: remove irq param to fix crash in fixed_phy_add()

On Mon, May 16, 2016 at 01:15:56PM +0200, Rabin Vincent wrote:
> From: Rabin Vincent <rabinv@...s.com>
> 
> Since e7f4dc3536a ("mdio: Move allocation of interrupts into core"),
> platforms which call fixed_phy_add() before fixed_mdio_bus_init() is
> called (for example, because the platform code and the fixed_phy driver
> use the same initcall level) crash in fixed_phy_add() since the
> ->mii_bus is not allocated.
> 
> Also since e7f4dc3536a, these interrupts are initalized to polling by
> default.  All callers of both fixed_phy_register() and fixed_phy_add()
> pass PHY_POLL for the irq argument, so we can fix these crashes by
> simply removing the irq parameter, since the default is correct for all
> users.

Hi Rabin

Thanks for the patch. However, this is more of a work around than a
fix. And it leaves one case still open for bad things to happen. Take
the call sequence:

	ret = of_phy_register_fixed_link(port_dn);
        if (ret) {
        	netdev_err(slave_dev, "failed to register fixed PHY: %d\n", ret);
                return ret;
  	}

	p->phy = of_phy_connect(slave_dev, phy_dn,
        			dsa_slave_adjust_link,
                                phy_flags,
                                p->phy_interface);

This is taken from net/dsa/slave.c

With your patch, of_phy_register_fixed_link() will be successful, but
the call to of_phy_connect() will fail, returning NULL, because the
mdio bus the phy is on has not yet been added to the bus.

What i think is better is to make fixed_phy_add() return -EPROBE_DEFER
if it is called before fixed_mdio_bus_init().

I also think it is a bad idea to remove the interrupt
parameter. fixed_phy can actually change it state, so maybe at some
point in the future, somebody will want an interrupt for this? We
should try to keep this phy emulation as similar to real phys as
possible, so lets keep the interrupt for the moment.

	Thanks
	  Andrew