linux/drivers
Andrew Goodbody cfe2556001 cpsw: Prevent NUll pointer dereference with two PHYs
Adding a 2nd PHY to cpsw results in a NULL pointer dereference
as below. Fix by maintaining a reference to each PHY node in slave
struct instead of a single reference in the priv struct which was
overwritten by the 2nd PHY.

[   17.870933] Unable to handle kernel NULL pointer dereference at virtual address 00000180
[   17.879557] pgd = dc8bc000
[   17.882514] [00000180] *pgd=9c882831, *pte=00000000, *ppte=00000000
[   17.889213] Internal error: Oops: 17 [#1] ARM
[   17.893838] Modules linked in:
[   17.897102] CPU: 0 PID: 1657 Comm: connmand Not tainted 4.5.0-ge463dfb-dirty #11
[   17.904947] Hardware name: Cambrionix whippet
[   17.909576] task: dc859240 ti: dc968000 task.ti: dc968000
[   17.915339] PC is at phy_attached_print+0x18/0x8c
[   17.920339] LR is at phy_attached_info+0x14/0x18
[   17.925247] pc : [<c042baec>]    lr : [<c042bb74>]    psr: 600f0113
[   17.925247] sp : dc969cf8  ip : dc969d28  fp : dc969d18
[   17.937425] r10: dda7a400  r9 : 00000000  r8 : 00000000
[   17.942971] r7 : 00000001  r6 : ddb00480  r5 : ddb8cb34  r4 : 00000000
[   17.949898] r3 : c0954cc0  r2 : c09562b0  r1 : 00000000  r0 : 00000000
[   17.956829] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
[   17.964401] Control: 10c5387d  Table: 9c8bc019  DAC: 00000051
[   17.970500] Process connmand (pid: 1657, stack limit = 0xdc968210)
[   17.977059] Stack: (0xdc969cf8 to 0xdc96a000)
[   17.981692] 9ce0:                                                       dc969d28 dc969d08
[   17.990386] 9d00: c038f9bc c038f6b4 ddb00480 dc969d34 dc969d28 c042bb74 c042bae4 00000000
[   17.999080] 9d20: c09562b0 c0954cc0 dc969d5c dc969d38 c043ebfc c042bb6c 00000007 00000003
[   18.007773] 9d40: ddb00000 ddb8cb58 ddb00480 00000001 dc969dec dc969d60 c0441614 c043ea68
[   18.016465] 9d60: 00000000 00000003 00000000 fffffff4 dc969df4 0000000d 00000000 00000000
[   18.025159] 9d80: dc969db4 dc969d90 c005dc08 c05839e0 dc969df4 0000000d ddb00000 00001002
[   18.033851] 9da0: 00000000 00000000 dc969dcc dc969db8 c005ddf4 c005dbc8 00000000 00000118
[   18.042544] 9dc0: dc969dec dc969dd0 ddb00000 c06db27c ffff9003 00001002 00000000 00000000
[   18.051237] 9de0: dc969e0c dc969df0 c057c88c c04410dc dc969e0c ddb00000 ddb00000 00000001
[   18.059930] 9e00: dc969e34 dc969e10 c057cb44 c057c7d8 ddb00000 ddb00138 00001002 beaeda20
[   18.068622] 9e20: 00000000 00000000 dc969e5c dc969e38 c057cc28 c057cac0 00000000 dc969e80
[   18.077315] 9e40: dda7a40c beaeda20 00000000 00000000 dc969ecc dc969e60 c05e36d0 c057cc14
[   18.086007] 9e60: dc969e84 00000051 beaeda20 00000000 dda7a40c 00000014 ddb00000 00008914
[   18.094699] 9e80: 30687465 00000000 00000000 00000000 00009003 00000000 00000000 00000000
[   18.103391] 9ea0: 00001002 00008914 dd257ae0 beaeda20 c098a428 beaeda20 00000011 00000000
[   18.112084] 9ec0: dc969edc dc969ed0 c05e4e54 c05e3030 dc969efc dc969ee0 c055f5ac c05e4cc4
[   18.120777] 9ee0: beaeda20 dd257ae0 dc8ab4c0 00008914 dc969f7c dc969f00 c010b388 c055f45c
[   18.129471] 9f00: c071ca40 dd257ac0 c00165e8 dc968000 dc969f3c dc969f20 dc969f64 dc969f28
[   18.138164] 9f20: c0115708 c0683ec8 dd257ac0 dd257ac0 dc969f74 dc969f40 c055f350 c00fc66c
[   18.146857] 9f40: dd82e4d0 00000011 00000000 00080000 dd257ac0 00000000 dc8ab4c0 dc8ab4c0
[   18.155550] 9f60: 00008914 beaeda20 00000011 00000000 dc969fa4 dc969f80 c010bc34 c010b2fc
[   18.164242] 9f80: 00000000 00000011 00000002 00000036 c00165e8 dc968000 00000000 dc969fa8
[   18.172935] 9fa0: c00163e0 c010bbcc 00000000 00000011 00000011 00008914 beaeda20 00009003
[   18.181628] 9fc0: 00000000 00000011 00000002 00000036 00081018 00000001 00000000 beaedc10
[   18.190320] 9fe0: 00083188 beaeda1c 00043a5d b6d29c0c 600b0010 00000011 00000000 00000000
[   18.198989] Backtrace:
[   18.201621] [<c042bad8>] (phy_attached_print) from [<c042bb74>] (phy_attached_info+0x14/0x18)
[   18.210664]  r3:c0954cc0 r2:c09562b0 r1:00000000
[   18.215588]  r4:ddb00480
[   18.218322] [<c042bb60>] (phy_attached_info) from [<c043ebfc>] (cpsw_slave_open+0x1a0/0x280)
[   18.227293] [<c043ea5c>] (cpsw_slave_open) from [<c0441614>] (cpsw_ndo_open+0x544/0x674)
[   18.235874]  r7:00000001 r6:ddb00480 r5:ddb8cb58 r4:ddb00000
[   18.241944] [<c04410d0>] (cpsw_ndo_open) from [<c057c88c>] (__dev_open+0xc0/0x128)
[   18.249972]  r9:00000000 r8:00000000 r7:00001002 r6:ffff9003 r5:c06db27c r4:ddb00000
[   18.258255] [<c057c7cc>] (__dev_open) from [<c057cb44>] (__dev_change_flags+0x90/0x154)
[   18.266745]  r5:00000001 r4:ddb00000
[   18.270575] [<c057cab4>] (__dev_change_flags) from [<c057cc28>] (dev_change_flags+0x20/0x50)
[   18.279523]  r9:00000000 r8:00000000 r7:beaeda20 r6:00001002 r5:ddb00138 r4:ddb00000
[   18.287811] [<c057cc08>] (dev_change_flags) from [<c05e36d0>] (devinet_ioctl+0x6ac/0x76c)
[   18.296483]  r9:00000000 r8:00000000 r7:beaeda20 r6:dda7a40c r5:dc969e80 r4:00000000
[   18.304762] [<c05e3024>] (devinet_ioctl) from [<c05e4e54>] (inet_ioctl+0x19c/0x1c8)
[   18.312882]  r10:00000000 r9:00000011 r8:beaeda20 r7:c098a428 r6:beaeda20 r5:dd257ae0
[   18.321235]  r4:00008914
[   18.323956] [<c05e4cb8>] (inet_ioctl) from [<c055f5ac>] (sock_ioctl+0x15c/0x2d8)
[   18.331829] [<c055f450>] (sock_ioctl) from [<c010b388>] (do_vfs_ioctl+0x98/0x8d0)
[   18.339765]  r7:00008914 r6:dc8ab4c0 r5:dd257ae0 r4:beaeda20
[   18.345822] [<c010b2f0>] (do_vfs_ioctl) from [<c010bc34>] (SyS_ioctl+0x74/0x84)
[   18.353573]  r10:00000000 r9:00000011 r8:beaeda20 r7:00008914 r6:dc8ab4c0 r5:dc8ab4c0
[   18.361924]  r4:00000000
[   18.364653] [<c010bbc0>] (SyS_ioctl) from [<c00163e0>] (ret_fast_syscall+0x0/0x3c)
[   18.372682]  r9:dc968000 r8:c00165e8 r7:00000036 r6:00000002 r5:00000011 r4:00000000
[   18.380960] Code: e92dd810 e24cb010 e24dd010 e59b4004 (e5902180)
[   18.387580] ---[ end trace c80529466223f3f3 ]---

Signed-off-by: Andrew Goodbody <andrew.goodbody@cambrionix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-04-15 17:24:37 -04:00
..
accessibility
acpi Merge branch 'acpi-processor' 2016-04-02 01:17:36 +02:00
amba
android
ata Merge branch 'for-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2016-03-18 20:06:46 -07:00
atm Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2016-03-17 21:38:27 -07:00
auxdisplay
base PM / wakeirq: fix wakeirq setting after wakup re-configuration from sysfs 2016-04-07 22:23:47 +02:00
bcma bcma: fix building without OF_IRQ 2016-03-23 17:52:10 +02:00
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client 2016-04-07 16:34:26 -07:00
bluetooth
bus arm[64] perf updates for 4.6: 2016-03-21 13:14:16 -07:00
cdrom
char Revert "ppdev: use new parport device model" 2016-03-25 09:02:13 -07:00
clk clk: qcom: ipq4019: add some fixed clocks for ddrppl and fepll 2016-03-29 16:31:16 -07:00
clocksource Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-24 10:32:42 -07:00
connector
cpufreq Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'acpi-cppc' 2016-04-08 21:46:05 +02:00
cpuidle cpuidle: menu: Fall back to polling if next timer event is near 2016-03-21 15:50:28 +01:00
crypto Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2016-03-23 06:12:39 -07:00
dca
devfreq PM / devfreq: Spelling s/frequnecy/frequency/ 2016-03-17 02:30:16 +01:00
dio
dma asm-generic changes for 4.6 2016-03-24 23:13:48 -07:00
dma-buf dma-buf: Update docs for SYNC ioctl 2016-03-21 09:26:45 +01:00
edac EDAC queue for 4.6 2016-03-16 08:36:55 -07:00
eisa
extcon
firewire IEEE 1394 subsystem patch: 2016-03-25 08:52:25 -07:00
firmware firmware: qemu_fw_cfg.c: hold ACPI global lock during device access 2016-04-07 15:16:40 +03:00
fmc
fpga
gpio gpio: xgene: Prevent NULL pointer dereference 2016-03-30 10:39:39 +02:00
gpu Merge branch 'drm-fixes-4.6' of git://people.freedesktop.org/~agd5f/linux into drm-fixes 2016-04-07 07:08:46 +10:00
hid drivers/hid/uhid.c: check write() bitness using in_compat_syscall 2016-03-22 15:36:02 -07:00
hsi
hv Char/Misc patches for 4.6-rc1 2016-03-17 13:47:50 -07:00
hwmon hwmon: (max1111) Return -ENODEV from max1111_read_channel if not instantiated 2016-03-27 10:37:48 -07:00
hwspinlock
hwtracing
i2c Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2016-03-22 12:47:40 -07:00
ide ide: palm_bk3710: test clock rate to avoid division by 0 2016-03-20 16:59:27 -04:00
idle intel_idle: Add KBL support 2016-04-07 22:11:08 +02:00
iio Second set of IIO fixes for the 4.6 cycle. 2016-04-04 13:45:10 -07:00
infiniband Revert "ib_srpt: Convert to percpu_ida tag allocation" 2016-04-07 18:16:20 -07:00
input Merge branch 'akpm' (patches from Andrew) 2016-03-25 16:59:11 -07:00
iommu iommu/vt-d: Silence an uninitialized variable warning 2016-04-07 14:51:47 +02:00
ipack
irqchip irqchip/mbigen: Make CONFIG_HISILICON_IRQ_MBIGEN a hidden option 2016-03-23 12:02:29 +01:00
isdn mISDN: Fixing missing validation in base_sock_bind() 2016-04-13 23:00:50 -04:00
leds platform-drivers-x86 for 4.6-1 2016-03-23 17:20:59 -07:00
lguest
lightnvm lightnvm: do not load L2P table if not supported 2016-03-18 18:10:38 -07:00
macintosh
mailbox Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'acpi-cppc' 2016-04-08 21:46:05 +02:00
mcb
md Merge tag 'md/4.6-rc2-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md 2016-04-09 11:23:27 -07:00
media media fixes for v4.6-rc2 2016-04-05 06:47:50 -07:00
memory MTD updates for v4.6 2016-03-24 19:57:15 -07:00
memstick drivers/memstick/host/r592.c: avoid gcc-6 warning 2016-03-25 16:37:42 -07:00
message
mfd - New Drivers 2016-03-18 10:15:11 -07:00
misc mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
mmc mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
mtd mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
net cpsw: Prevent NUll pointer dereference with two PHYs 2016-04-15 17:24:37 -04:00
nfc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2016-03-19 10:05:34 -07:00
ntb NTB: Remove _addr functions from ntb_hw_amd 2016-03-26 11:44:33 -04:00
nubus
nvdimm mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
nvme nvme: avoid cqe corruption when update at the same time as read 2016-03-22 10:27:29 -06:00
nvmem
of DeviceTree updates for 4.6: 2016-03-19 15:15:07 -07:00
oprofile mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
parisc PCI changes for the v4.6 merge window: 2016-03-16 14:45:55 -07:00
parport
pci Revert "PCI: dra7xx: Mark driver as broken" 2016-03-22 07:50:11 -05:00
pcmcia pcmcia: db1xxx_ss: fix last irq_to_gpio user 2016-03-29 22:48:53 +02:00
perf drivers/perf: arm_pmu: avoid NULL dereference when not using devicetree 2016-03-21 11:36:17 +00:00
phy
pinctrl Revert "Revert "pinctrl: lantiq: Implement gpio_chip.to_irq"" 2016-04-01 15:21:27 +02:00
platform Convert straggling drivers to new six-argument get_user_pages() 2016-04-02 18:35:05 -05:00
pnp
power Power management and ACPI material for v4.6-rc1, part 2 2016-03-25 16:55:37 -07:00
powercap powercap: intel_rapl: Add missing Haswell model 2016-04-05 03:44:48 +02:00
pps
ps3
ptp Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-03-15 12:13:56 -07:00
pwm pwm: omap-dmtimer: Add debug message for effective period and duty cycle 2016-03-23 17:11:48 +01:00
rapidio Convert straggling drivers to new six-argument get_user_pages() 2016-04-02 18:35:05 -05:00
ras
regulator - New Drivers 2016-03-18 10:15:11 -07:00
remoteproc remoteproc: st: fix check of syscon_regmap_lookup_by_phandle() return value 2016-03-28 16:19:00 -07:00
reset
rpmsg
rtc RTC for 4.6 #2 2016-03-24 22:49:08 -07:00
s390 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux 2016-04-01 07:15:54 -05:00
sbus
scsi SCSI fixes on 20160408 2016-04-09 12:00:42 -07:00
sfi
sh
sn
soc ARM: SoC driver updates for v4.6 2016-03-20 15:40:32 -07:00
spi Merge remote-tracking branches 'spi/fix/omap2' and 'spi/fix/rockchip' into spi-linus 2016-04-04 10:05:49 -07:00
spmi
ssb
staging Staging / IIO driver fixes for 4.6-rc3 2016-04-09 12:09:37 -07:00
target target: add a new add_wwn_groups fabrics method 2016-03-30 20:06:44 -07:00
tc
thermal Thermal: Ignore invalid trip points 2016-03-18 14:10:57 +08:00
thunderbolt
tty tty: Fix merge of "tty: Refactor tty_open()" 2016-03-31 20:49:39 -07:00
uio
usb USB fixes for 4.6-rc3 2016-04-09 12:23:02 -07:00
uwb
vfio VFIO updates for v4.6-rc1 2016-03-17 13:05:09 -07:00
vhost Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending 2016-03-22 12:41:14 -07:00
video mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros 2016-04-04 10:41:08 -07:00
virt
virtio virtio: virtio 1.0 cs04 spec compliance for reset 2016-04-07 15:16:39 +03:00
vlynq
vme
w1
watchdog hpwdt: use nmi_panic() when kernel panics in NMI handler 2016-03-22 15:36:02 -07:00
xen xen/events: Mask a moving irq 2016-04-04 11:18:00 +01:00
zorro
Kconfig
Makefile