linux/drivers/net
Vladimir Oltean 74b6d7d133 net: dsa: realtek: register the MDIO bus under devres
The Linux device model permits both the ->shutdown and ->remove driver
methods to get called during a shutdown procedure. Example: a DSA switch
which sits on an SPI bus, and the SPI bus driver calls this on its
->shutdown method:

spi_unregister_controller
-> device_for_each_child(&ctlr->dev, NULL, __unregister);
   -> spi_unregister_device(to_spi_device(dev));
      -> device_del(&spi->dev);

So this is a simple pattern which can theoretically appear on any bus,
although the only other buses on which I've been able to find it are
I2C:

i2c_del_adapter
-> device_for_each_child(&adap->dev, NULL, __unregister_client);
   -> i2c_unregister_device(client);
      -> device_unregister(&client->dev);

The implication of this pattern is that devices on these buses can be
unregistered after having been shut down. The drivers for these devices
might choose to return early either from ->remove or ->shutdown if the
other callback has already run once, and they might choose that the
->shutdown method should only perform a subset of the teardown done by
->remove (to avoid unnecessary delays when rebooting).

So in other words, the device driver may choose on ->remove to not
do anything (therefore to not unregister an MDIO bus it has registered
on ->probe), because this ->remove is actually triggered by the
device_shutdown path, and its ->shutdown method has already run and done
the minimally required cleanup.

This used to be fine until the blamed commit, but now, the following
BUG_ON triggers:

void mdiobus_free(struct mii_bus *bus)
{
	/* For compatibility with error handling in drivers. */
	if (bus->state == MDIOBUS_ALLOCATED) {
		kfree(bus);
		return;
	}

	BUG_ON(bus->state != MDIOBUS_UNREGISTERED);
	bus->state = MDIOBUS_RELEASED;

	put_device(&bus->dev);
}

In other words, there is an attempt to free an MDIO bus which was not
unregistered. The attempt to free it comes from the devres release
callbacks of the SPI device, which are executed after the device is
unregistered.

I'm not saying that the fact that MDIO buses allocated using devres
would automatically get unregistered wasn't strange. I'm just saying
that the commit didn't care about auditing existing call paths in the
kernel, and now, the following code sequences are potentially buggy:

(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device
    located on a bus that unregisters its children on shutdown. After
    the blamed patch, either both the alloc and the register should use
    devres, or none should.

(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no
    mdiobus_unregister at all in the remove path. After the blamed
    patch, nobody unregisters the MDIO bus anymore, so this is even more
    buggy than the previous case which needs a specific bus
    configuration to be seen, this one is an unconditional bug.

In this case, the Realtek drivers fall under category (b). To solve it,
we can register the MDIO bus under devres too, which restores the
previous behavior.

Fixes: ac3a68d566 ("net: phy: don't abuse devres in devm_mdiobus_register()")
Reported-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Reported-by: Alvin Šipraga <alsi@bang-olufsen.dk>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-09-21 13:52:16 +01:00
..
appletalk
arcnet
bonding bonding: 3ad: pass parameter bond_params by reference 2021-09-07 10:28:50 +01:00
caif
can can: c_can: fix null-ptr-deref on ioctl() 2021-09-07 08:46:58 +02:00
dsa net: dsa: realtek: register the MDIO bus under devres 2021-09-21 13:52:16 +01:00
ethernet net: hns3: fix a return value error in hclge_get_reset_status() 2021-09-20 13:28:39 +01:00
fddi fddi: switch from 'pci_' to 'dma_' API 2021-08-29 10:50:24 +01:00
fjes
hamradio net: 6pack: Fix tx timeout and slot time 2021-09-16 12:52:06 -07:00
hippi
hyperv
ieee802154
ipa net: ipa: initialize all filter table slots 2021-09-08 12:10:33 +01:00
ipvlan
mctp
mdio net: mdio: mscc-miim: Make use of the helper function devm_platform_ioremap_resource() 2021-08-31 12:07:05 +01:00
netdevsim Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
pcs net: update NXP copyright text 2021-09-17 13:52:17 +01:00
phy net: mdio: introduce a shutdown method to mdio device drivers 2021-09-19 12:08:37 +01:00
plip
ppp
slip
team
usb net: hso: fix muxed tty registration 2021-09-17 11:19:58 +01:00
vmxnet3 ethtool: extend coalesce setting uAPI with CQE mode 2021-08-24 07:38:29 -07:00
wan net: wan: wanxl: define CROSS_COMPILE_M68K 2021-09-16 14:08:04 +01:00
wireguard
wireless Networking stragglers and fixes for 5.15-rc1, including changes from netfilter, 2021-09-07 14:02:58 -07:00
wwan Networking stragglers and fixes for 5.15-rc1, including changes from netfilter, 2021-09-07 14:02:58 -07:00
xen-netback xen-netback: correct success/error reporting for the SKB-with-fraglist case 2021-09-19 12:10:26 +01:00
bareudp.c
dummy.c
eql.c
geneve.c
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c
macvtap.c
Makefile
mdio.c
mhi_net.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-08-26 17:57:57 -07:00
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c ethtool: extend coalesce setting uAPI with CQE mode 2021-08-24 07:38:29 -07:00
veth.c
virtio_net.c virtio-net: fix pages leaking when building skb in big mode 2021-09-19 12:10:26 +01:00
vrf.c
vsockmon.c
vxlan.c
xen-netfront.c xen/netfront: don't trust the backend response data blindly 2021-08-25 10:43:21 +01:00