linux-kernel - Re: [PATCH] net: smsc911x: Fix unload crash when link is up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 6 Mar 2018 09:40:39 -0600
From:   Jeremy Linton <jeremy.linton@....com>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "steve.glendinning@...well.net" <steve.glendinning@...well.net>,
        Matt Sealey <Matt.Sealey@....com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] net: smsc911x: Fix unload crash when link is up

Hi,

On 03/06/2018 09:23 AM, Andrew Lunn wrote:
>> This is caused by the mdiobus being unregistered/free'd
>> and the code in phy_detach() attempting to manipulate mdio
>> related structures from unregister_netdev() calling close()
>>
>> To fix this, we delay the mdiobus teardown until after
>> the netdev is deregistered.
>>
>> Reported-by: Matt Sealey <matt.sealey@....com>
>> Signed-off-by: Jeremy Linton <jeremy.linton@....com>
>> ---
>>   drivers/net/ethernet/smsc/smsc911x.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
>> index 012fb66eed8d..f0afb88d7bc2 100644
>> --- a/drivers/net/ethernet/smsc/smsc911x.c
>> +++ b/drivers/net/ethernet/smsc/smsc911x.c
>> @@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev)
>>   	pdata = netdev_priv(dev);
>>   	BUG_ON(!pdata);
>>   	BUG_ON(!pdata->ioaddr);
>> -	WARN_ON(dev->phydev);
> 
> Hi Jeremy
> 
> I assume this WARN_ON() also fired? It would be good to comment about
> why you removed it, that the code now handles that case.

Yes, the phydev is started and assigned in the netdev _open and 
stopped/set to null in the _stop. Since the module remove is not blocked 
by having the netdev active, and unregister_netdev closes out active 
connections, the WARN_ON would needlessly trigger if the netdev was 
still open.

> 
> Apart from that
> 
> Reviewed-by: Andrew Lunn <andrew@...n.ch>

Thanks for looking at this.