netdev - NPD in phy_led_set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <9e6da1b3-3749-90e9-6a6a-4775463f5942@gmail.com>
Date: Wed, 7 Jun 2023 13:50:42 -0700
From: Florian Fainelli <f.fainelli@...il.com>
To: "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
 Andrew Lunn <andrew@...n.ch>, Heiner Kallweit <hkallweit1@...il.com>,
 Christian Marangi <ansuelsmth@...il.com>
Cc: Vladimir Oltean <olteanv@...il.com>, Pavel Machek <pavel@....cz>,
 Lee Jones <lee@...nel.org>,
 "linux-leds@...r.kernel.org" <linux-leds@...r.kernel.org>
Subject: NPD in phy_led_set_brightness+0x3c

Hi all,

While adding support for configuring the LEDs with Broadcom PHYs, I 
stumbled upon the NPD below which happens while issuing a reboot. The 
driver being used is GENET which calls phy_disconnect() in its 
shutdown/remove path. This is also reproducible by unbinding the MDIO 
bus controller driver, e.g.:

# echo unimac-mdio.0 > unbind

The relevant section of the DT for this platform is the following:

                                         leds {
                                                 leds@2 {
                                                         default-state = 
"keep";
                                                         color = <0x4>;
                                                         reg = <0x2>;
                                                 };
                                                 leds@1 {
                                                         default-state = 
"keep";
                                                         color = <0x2>;
                                                         reg = <0x1>;
                                                 };
                                         };


There is no trigger being configured for either LED therefore it is not 
clear to me why the workqueue is being kicked in the first place?

# cat /sys/class/leds/
mmc0::/                  unimac-mdio-0:19:amber:/
mmc1::/                  unimac-mdio-0:19:green:/
# cat /sys/class/leds/unimac-mdio-0\:19\:
unimac-mdio-0:19:amber:/ unimac-mdio-0:19:green:/
# cat /sys/class/leds/unimac-mdio-0\:19\:green\:/trigger
[none] rfkill-any rfkill-none kbd-scrolllock kbd-numlock kbd-capslock 
kbd-kanalock kbd-shiftlock kbd-altgrlock kbd-ctrllock kbd-altlock 
kbd-shiftllock kbd-shiftrlock kbd-ctrlllock kbd-ctrlrlock mmc1 mmc0
# cat /sys/class/leds/unimac-mdio-0\:19\:amber\:/trigger
[none] rfkill-any rfkill-none kbd-scrolllock kbd-numlock kbd-capslock 
kbd-kanalock kbd-shiftlock kbd-altgrlock kbd-ctrllock kbd-altlock 
kbd-shiftllock kbd-shiftrlock kbd-ctrlllock kbd-ctrlrlock mmc1 mmc0
# reboot -f
[   55.476856] bcmgenet 8f00000.ethernet eth0: Link is Down
[   55.553834] Unable to handle kernel NULL pointer dereference at 
virtual address 00000000000001f0
[   55.562674] Mem abort info:
[   55.565482]   ESR = 0x0000000096000005
[   55.569245]   EC = 0x25: DABT (current EL), IL = 32 bits
[   55.574575]   SET = 0, FnV = 0
[   55.577641]   EA = 0, S1PTW = 0
[   55.580797]   FSC = 0x05: level 1 translation fault
[   55.585690] Data abort info:
[   55.588582]   ISV = 0, ISS = 0x00000005
[   55.592432]   CM = 0, WnR = 0
[   55.595410] user pgtable: 4k pages, 39-bit VAs, pgdp=000000004815d000
[   55.601870] [00000000000001f0] pgd=0000000000000000, 
p4d=0000000000000000, pud=0000000000000000
[   55.610601] Internal error: Oops: 0000000096000005 [#1] SMP
[   55.616190] Modules linked in: bdc udc_core
[   55.620394] CPU: 2 PID: 46 Comm: kworker/2:1 Not tainted 
6.4.0-rc1-g665543a0726c #76
[   55.628156] Hardware name: BCM972180HB_V20 (DT)
[   55.632697] Workqueue: events set_brightness_delayed
[   55.637691] pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS 
BTYPE=--)
[   55.644669] pc : phy_led_set_brightness+0x3c/0x68
[   55.649389] lr : phy_led_set_brightness+0x30/0x68
[   55.654105] sp : ffffffc00acabd10
[   55.657425] x29: ffffffc00acabd10 x28: 0000000000000000 x27: 
0000000000000000
[   55.664581] x26: 0000000000000000 x25: ffffff807dbb340d x24: 
0000000000000000
[   55.671736] x23: ffffff807dbb3400 x22: 0000000000000000 x21: 
ffffff8002e59c80
[   55.678891] x20: ffffff8003d1f520 x19: ffffff8003d1f000 x18: 
0000000000000000
[   55.686046] x17: 74656e2f74656e72 x16: 656874652e303030 x15: 
303066382f626472
[   55.693202] x14: ffffff8003022de0 x13: 6e69622f7273752f x12: 
0000000000000000
[   55.700357] x11: ffffff8002d1d510 x10: 0000000000000870 x9 : 
ffffffc008660a7c
[   55.707512] x8 : ffffff8002e77374 x7 : fefefefefefefeff x6 : 
000073746e657665
[   55.714667] x5 : ffffff8002e77374 x4 : 0000000000000000 x3 : 
0000000000000000
[   55.721822] x2 : 0000000000000000 x1 : 0000000000000001 x0 : 
0000000000000000
[   55.728978] Call trace:
[   55.731431]  phy_led_set_brightness+0x3c/0x68
[   55.735800]  set_brightness_delayed_set_brightness+0x44/0x7c
[   55.741476]  set_brightness_delayed+0xc4/0x1a4
[   55.745932]  process_one_work+0x1a4/0x254
[   55.749958]  process_scheduled_works+0x44/0x48
[   55.754415]  worker_thread+0x1e8/0x264
[   55.758176]  kthread+0xcc/0xdc
[   55.761242]  ret_from_fork+0x10/0x20
[   55.764833] Code: 940ed4c5 f941a660 2a1603e2 394622a1 (f940f803)
[   55.770941] ---[ end trace 0000000000000000 ]---
-- 
Florian