netdev - [BUG] rmmod bfin_mac netdev driver module will cause system crash.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <386072610811040045w2944a856jd55809f0a7532dbd@mail.gmail.com>
Date:	Tue, 4 Nov 2008 16:45:13 +0800
From:	"Bryan Wu" <cooloney@...nel.org>
To:	"Lennert Buytenhek" <buytenh@...tstofly.org>
Cc:	netdev@...r.kernel.org, "Andy Fleming" <afleming@...escale.com>,
	"Byron Bradley" <byron.bbradley@...il.com>,
	"Tim Ellis" <tim.ellis@....com>, "Imre Kaloz" <kaloz@...nwrt.org>,
	"Nicolas Pitre" <nico@....org>, "Dirk Teurlings" <dirk@...xia.nl>,
	"Peter van Valderen" <p.v.valderen@...il.com>
Subject: [BUG] rmmod bfin_mac netdev driver module will cause system crash.

Hi Lennert,

I got a regression since I update our blackfin kernel to the lastest
2.6.28-rc2 which includes your phylib patches.
Please find the tracker here:
https://blackfin.uclinux.org/gf/project/uclinux-dist/tracker/?action=TrackerItemEdit&tracker_id=141&tracker_item_id=4595

Briefly, the calling chain is:
in bfin_mac_remove(), mdiobus_unregister() ->
device_unregister(&bus->dev); -> put_device() -> kobject_put() ->
kref_put(&kobj->kref, kobject_release); -> kobject_release() ->
kobject_cleanup() -> mdiobus_release().
So in mdiobus_unregister() bus->state = MDIOBUS_UNREGISTERED; but in
mdiobus_release(), this BUG_ON will fire:
BUG_ON(bus->state != MDIOBUS_RELEASED);

How about this patch?

---
Index: drivers/net/phy/mdio_bus.c
===================================================================
--- drivers/net/phy/mdio_bus.c	(revision 5575)
+++ drivers/net/phy/mdio_bus.c	(working copy)
@@ -134,13 +134,16 @@
 	int i;

 	BUG_ON(bus->state != MDIOBUS_REGISTERED);
-	bus->state = MDIOBUS_UNREGISTERED;

+	bus->state = MDIOBUS_RELEASED;
+
 	device_unregister(&bus->dev);
 	for (i = 0; i < PHY_MAX_ADDR; i++) {
 		if (bus->phy_map[i])
 			device_unregister(&bus->phy_map[i]->dev);
 	}
+
+	bus->state = MDIOBUS_UNREGISTERED;
 }
 EXPORT_SYMBOL(mdiobus_unregister);
---

This regression is gone, but I'm not sure whether there is some side effect.
Please review.

Thanks a lot
-Bryan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html