linux-kernel - [RFC net-next v3 1/2] net: phy: phy_device Prevent nullptr exceptions on ISR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 19 Jan 2024 10:32:25 +0100
From: Andre Werner <andre.werner@...tec-electronic.com>
To: andrew@...n.ch,
	hkallweit1@...il.com,
	davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com
Cc: linux@...linux.org.uk,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	Andre Werner <andre.werner@...tec-electronic.com>
Subject: [RFC net-next v3 1/2] net: phy: phy_device Prevent nullptr exceptions on ISR

If phydev->irq is set unconditionally by MAC drivers, check
for valid interrupt handler or fall back to polling mode to prevent
nullptr exceptions.

Signed-off-by: Andre Werner <andre.werner@...tec-electronic.com>
---
v3:
- No changes to v2. Just to complete the series.
---
 drivers/net/phy/phy_device.c | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 3611ea64875e..3986e103d25e 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1413,6 +1413,11 @@ int phy_sfp_probe(struct phy_device *phydev,
 }
 EXPORT_SYMBOL(phy_sfp_probe);
 
+static bool phy_drv_supports_irq(struct phy_driver *phydrv)
+{
+	return phydrv->config_intr && phydrv->handle_interrupt;
+}
+
 /**
  * phy_attach_direct - attach a network device to a given PHY device pointer
  * @dev: network device to attach
@@ -1527,6 +1532,18 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 	if (phydev->dev_flags & PHY_F_NO_IRQ)
 		phydev->irq = PHY_POLL;
 
+	/*
+	 * Some drivers may add IRQ numbers unconditionally to a phy device that does
+	 * not implement an interrupt handler after phy_probe is already done.
+	 * Reset to PHY_POLL to prevent nullptr exceptions in that case.
+	 */
+	if (!phy_drv_supports_irq(phydev->drv) && phy_interrupt_is_valid(phydev)) {
+		phydev_warn(phydev,
+			    "No handler for IRQ=%d available. Falling back to polling mode\n",
+			    phydev->irq);
+		phydev->irq = PHY_POLL;
+	}
+
 	/* Port is set to PORT_TP by default and the actual PHY driver will set
 	 * it to different value depending on the PHY configuration. If we have
 	 * the generic PHY driver we can't figure it out, thus set the old
@@ -2992,11 +3009,6 @@ s32 phy_get_internal_delay(struct phy_device *phydev, struct device *dev,
 }
 EXPORT_SYMBOL(phy_get_internal_delay);
 
-static bool phy_drv_supports_irq(struct phy_driver *phydrv)
-{
-	return phydrv->config_intr && phydrv->handle_interrupt;
-}
-
 static int phy_led_set_brightness(struct led_classdev *led_cdev,
 				  enum led_brightness value)
 {
-- 
2.43.0