netdev - Re: [PATCH net] net: mscc: ocelot: unregister the PTP clock on deinit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 27 Nov 2019 20:00:22 -0800
From:   Florian Fainelli <f.fainelli@...il.com>
To:     Vladimir Oltean <olteanv@...il.com>, davem@...emloft.net,
        richardcochran@...il.com
Cc:     andrew@...n.ch, vivien.didelot@...il.com, claudiu.manoil@....com,
        alexandru.marginean@....com, xiaoliang.yang_1@....com,
        yangbo.lu@....com, netdev@...r.kernel.org,
        alexandre.belloni@...tlin.com, UNGLinuxDriver@...rochip.com,
        Vladimir Oltean <vladimir.oltean@....com>
Subject: Re: [PATCH net] net: mscc: ocelot: unregister the PTP clock on deinit



On 11/27/2019 5:56 PM, Vladimir Oltean wrote:
> From: Vladimir Oltean <vladimir.oltean@....com>
> 
> Currently a switch driver deinit frees the regmaps, but the PTP clock is
> still out there, available to user space via /dev/ptpN. Any PTP
> operation is a ticking time bomb, since it will attempt to use the freed
> regmaps and thus trigger kernel panics:
> 
> [    4.291746] fsl_enetc 0000:00:00.2 eth1: error -22 setting up slave phy
> [    4.291871] mscc_felix 0000:00:00.5: Failed to register DSA switch: -22
> [    4.308666] mscc_felix: probe of 0000:00:00.5 failed with error -22
> [    6.358270] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000088
> [    6.367090] Mem abort info:
> [    6.369888]   ESR = 0x96000046
> [    6.369891]   EC = 0x25: DABT (current EL), IL = 32 bits
> [    6.369892]   SET = 0, FnV = 0
> [    6.369894]   EA = 0, S1PTW = 0
> [    6.369895] Data abort info:
> [    6.369897]   ISV = 0, ISS = 0x00000046
> [    6.369899]   CM = 0, WnR = 1
> [    6.369902] user pgtable: 4k pages, 48-bit VAs, pgdp=00000020d58c7000
> [    6.369904] [0000000000000088] pgd=00000020d5912003, pud=00000020d5915003, pmd=0000000000000000
> [    6.369914] Internal error: Oops: 96000046 [#1] PREEMPT SMP
> [    6.420443] Modules linked in:
> [    6.423506] CPU: 1 PID: 262 Comm: phc_ctl Not tainted 5.4.0-03625-gb7b2a5dadd7f #204
> [    6.431273] Hardware name: LS1028A RDB Board (DT)
> [    6.435989] pstate: 40000085 (nZcv daIf -PAN -UAO)
> [    6.440802] pc : css_release+0x24/0x58
> [    6.444561] lr : regmap_read+0x40/0x78
> [    6.448316] sp : ffff800010513cc0
> [    6.451636] x29: ffff800010513cc0 x28: ffff002055873040
> [    6.456963] x27: 0000000000000000 x26: 0000000000000000
> [    6.462289] x25: 0000000000000000 x24: 0000000000000000
> [    6.467617] x23: 0000000000000000 x22: 0000000000000080
> [    6.472944] x21: ffff800010513d44 x20: 0000000000000080
> [    6.478270] x19: 0000000000000000 x18: 0000000000000000
> [    6.483596] x17: 0000000000000000 x16: 0000000000000000
> [    6.488921] x15: 0000000000000000 x14: 0000000000000000
> [    6.494247] x13: 0000000000000000 x12: 0000000000000000
> [    6.499573] x11: 0000000000000000 x10: 0000000000000000
> [    6.504899] x9 : 0000000000000000 x8 : 0000000000000000
> [    6.510225] x7 : 0000000000000000 x6 : ffff800010513cf0
> [    6.515550] x5 : 0000000000000000 x4 : 0000000fffffffe0
> [    6.520876] x3 : 0000000000000088 x2 : ffff800010513d44
> [    6.526202] x1 : ffffcada668ea000 x0 : ffffcada64d8b0c0
> [    6.531528] Call trace:
> [    6.533977]  css_release+0x24/0x58
> [    6.537385]  regmap_read+0x40/0x78
> [    6.540795]  __ocelot_read_ix+0x6c/0xa0
> [    6.544641]  ocelot_ptp_gettime64+0x4c/0x110
> [    6.548921]  ptp_clock_gettime+0x4c/0x58
> [    6.552853]  pc_clock_gettime+0x5c/0xa8
> [    6.556699]  __arm64_sys_clock_gettime+0x68/0xc8
> [    6.561331]  el0_svc_common.constprop.2+0x7c/0x178
> [    6.566133]  el0_svc_handler+0x34/0xa0
> [    6.569891]  el0_sync_handler+0x114/0x1d0
> [    6.573908]  el0_sync+0x140/0x180
> [    6.577232] Code: d503201f b00119a1 91022263 b27b7be4 (f9004663)
> [    6.583349] ---[ end trace d196b9b14cdae2da ]---
> [    6.587977] Kernel panic - not syncing: Fatal exception
> [    6.593216] SMP: stopping secondary CPUs
> [    6.597151] Kernel Offset: 0x4ada54400000 from 0xffff800010000000
> [    6.603261] PHYS_OFFSET: 0xffffd0a7c0000000
> [    6.607454] CPU features: 0x10002,21806008
> [    6.611558] Memory Limit: none
> [    6.614620] Rebooting in 3 seconds..
> 
> Fixes: 4e3b0468e6d7 ("net: mscc: PTP Hardware Clock (PHC) support")
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>

Reviewed-by: Florian Fainelli <f.fainelli@...il.com>

Tag valid for either this version or Yangbo's suggestion.
-- 
Florian