| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <6d3c8253-1e31-761f-4b50-0bf087047753@gmail.com>
Date: Tue, 22 Aug 2017 12:01:32 -0700
From: Florian Fainelli <f.fainelli@...il.com>
To: Priit Laes <plaes@...es.org>,
Romain Perier <romain.perier@...labora.com>,
Andrew Lunn <andrew@...n.ch>,
"David S. Miller" <davem@...emloft.net>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
Chen-Yu Tsai <wens@...e.org>,
Maxime Ripard <maxime.ripard@...e-electrons.com>
Subject: Re: Crash due to fbca164776e438 - "net: stmmac: Use the right logging
function in stmmac_mdio_register"
On 08/22/2017 11:47 AM, Priit Laes wrote:
> Hi!
>
> I'm running into following crash during boot on Cubietruck A20, with the patch
> fbca164776e438
> (net: stmmac: Use the right logging function in stmmac_mdio_register) applied:
>
> [snip]
> sun7i-dwmac 1c50000.ethernet: PTP uses main clock
> sun7i-dwmac 1c50000.ethernet: no reset control found
> sun7i-dwmac 1c50000.ethernet: no regulator found
> sun7i-dwmac 1c50000.ethernet: Ring mode enabled
> sun7i-dwmac 1c50000.ethernet: DMA HW capability register supported
> sun7i-dwmac 1c50000.ethernet: Normal descriptors
> libphy: stmmac: probed
> Unable to handle kernel NULL pointer dereference at virtual address 00000048
Yes indeed:
(gdb) p/x (int)&((struct phy_driver *)0)->name
$2 = 0x48
The following should fix it:
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9493fb369682..810f6fd2f639 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -877,15 +877,17 @@ EXPORT_SYMBOL(phy_attached_info);
#define ATTACHED_FMT "attached PHY driver [%s] (mii_bus:phy_addr=%s,
irq=%d)"
void phy_attached_print(struct phy_device *phydev, const char *fmt, ...)
{
+ const char *drv_name = phydev->drv ? phydev->drv->name : "unbound";
+
if (!fmt) {
dev_info(&phydev->mdio.dev, ATTACHED_FMT "\n",
- phydev->drv->name, phydev_name(phydev),
+ drv_name, phydev_name(phydev),
phydev->irq);
} else {
va_list ap;
dev_info(&phydev->mdio.dev, ATTACHED_FMT,
- phydev->drv->name, phydev_name(phydev),
+ drv_name, phydev_name(phydev),
phydev->irq);
va_start(ap, fmt);
> pgd = c0004000
> [00000048] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in:
> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.13.0-rc6-00318-g0065bd7fa384 #1
> Hardware name: Allwinner sun7i (A20) Family
> task: ee868000 task.stack: ee85c000
> PC is at phy_attached_print+0x1c/0x8c
> LR is at stmmac_mdio_register+0x12c/0x200
> pc : [<c04510ac>] lr : [<c045e6b4>] psr: 60000013
> sp : ee85ddc8 ip : 00000000 fp : c07dfb5c
> r10: ee981210 r9 : 00000001 r8 : eea73000
> r7 : eeaa6dd0 r6 : eeb49800 r5 : 00000000 r4 : 00000000
> r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : eeb49800
> Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
> Control: 10c5387d Table: 4000406a DAC: 00000051
> Process swapper/0 (pid: 1, stack limit = 0xee85c210)
> Stack: (0xee85ddc8 to 0xee85e000)
> ddc0: 00000000 00000002 eeb49400 eea72000 00000000 eeb49400
> dde0: c045e6b4 00000000 ffffffff eeab0810 00000000 c08051f8 ee9292c0 c016d480
> de00: eea725c0 eea73000 eea72000 00000001 eea726c0 c0457d0c 00000040 00000020
> de20: 00000000 c045b850 00000001 00000000 ee981200 eeab0810 eeaa6ed0 ee981210
> de40: 00000000 c094a4a0 00000000 c0465180 eeaa7550 f08d0000 c9ffb90c 00000032
> de60: fffffffa 00000032 ee981210 ffffffed c0a46620 fffffdfb c0a46620 c03f7be8
> de80: ee981210 c0a9a388 00000000 00000000 c0a46620 c03f63e0 ee981210 c0a46620
> dea0: ee981244 00000000 00000007 000000c6 c094a4a0 c03f6534 00000000 c0a46620
> dec0: c03f6490 c03f49ec ee828a58 ee9217b4 c0a46620 eeaa4b00 c0a43230 c03f59fc
> dee0: c08051f8 c094a49c c0a46620 c0a46620 00000000 c091c668 c093783c c03f6dfc
> df00: ffffe000 00000000 c091c668 c010177c eefe0938 eefe0935 c085e200 000000c6
> df20: 00000005 c0136bc8 60000013 c080b3a4 00000006 00000006 c07ce7b4 00000000
> df40: c07d7ddc c07cef28 eefe0938 eefe093e c0a0b2f0 c0a641c0 c0a641c0 c0a641c0
> df60: c0937834 00000007 000000c6 c094a4a0 00000000 c0900d88 00000006 00000006
> df80: 00000000 c09005a8 00000000 c060ecf4 00000000 00000000 00000000 00000000
> dfa0: 00000000 c060ecfc 00000000 c0107738 00000000 00000000 00000000 00000000
> dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffdeffff ffffffff
> [<c04510ac>] (phy_attached_print) from [<c045e6b4>] (stmmac_mdio_register+0x12c/0x200)
> [<c045e6b4>] (stmmac_mdio_register) from [<c045b850>] (stmmac_dvr_probe+0x850/0x96c)
> [<c045b850>] (stmmac_dvr_probe) from [<c0465180>] (sun7i_gmac_probe+0x120/0x180)
> [<c0465180>] (sun7i_gmac_probe) from [<c03f7be8>] (platform_drv_probe+0x50/0xac)
> [<c03f7be8>] (platform_drv_probe) from [<c03f63e0>] (driver_probe_device+0x234/0x2e4)
> [<c03f63e0>] (driver_probe_device) from [<c03f6534>] (__driver_attach+0xa4/0xa8)
> [<c03f6534>] (__driver_attach) from [<c03f49ec>] (bus_for_each_dev+0x4c/0x9c)
> [<c03f49ec>] (bus_for_each_dev) from [<c03f59fc>] (bus_add_driver+0x190/0x214)
> [<c03f59fc>] (bus_add_driver) from [<c03f6dfc>] (driver_register+0x78/0xf4)
> [<c03f6dfc>] (driver_register) from [<c010177c>] (do_one_initcall+0x44/0x168)
> [<c010177c>] (do_one_initcall) from [<c0900d88>] (kernel_init_freeable+0x144/0x1d0)
> [<c0900d88>] (kernel_init_freeable) from [<c060ecfc>] (kernel_init+0x8/0x110)
> [<c060ecfc>] (kernel_init) from [<c0107738>] (ret_from_fork+0x14/0x3c)
> Code: e59021c8 e59d401c e590302c e3540000 (e5922048)
> ---[ end trace 39ae87c7923562d0 ]---
> Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> [/snip]
>
> After reverting said patch, there are no issues.
>
> Päikest,
> Priit Laes
>
--
Florian
Powered by blists - more mailing lists