Commit 126d6848 authored Sep 18, 2018 by Russell King Committed by David S. Miller Sep 18, 2018

sfp: fix oops with ethtool -m



If a network interface is created prior to the SFP socket being
available, ethtool can request module information.  This unfortunately
leads to an oops:

Unable to handle kernel NULL pointer dereference at virtual address 00000008
pgd = (ptrval)
[00000008] *pgd=7c400831, *pte=00000000, *ppte=00000000
Internal error: Oops: 17 [#1] SMP ARM
Modules linked in:
CPU: 0 PID: 1480 Comm: ethtool Not tainted 4.19.0-rc3 #138
Hardware name: Broadcom Northstar Plus SoC
PC is at sfp_get_module_info+0x8/0x10
LR is at dev_ethtool+0x218c/0x2afc

Fix this by not filling in the network device's SFP bus pointer until
SFP is fully bound, thereby avoiding the core calling into the SFP bus
code.

Fixes: ce0aa27f ("sfp: add sfp-bus to bridge between network devices and sfp cages")
Reported-by: Florian Fainelli <f.fainelli@gmail.com>
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 774268f3

drivers/net/phy/sfp-bus.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -349,6 +349,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
		}
		if (bus->started)
		bus->socket_ops->start(bus->sfp);
		bus->netdev->sfp_bus = bus;
		bus->registered = true;
		return 0;
		}
		@@ -357,6 +358,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
		{
		const struct sfp_upstream_ops *ops = bus->upstream_ops;

		bus->netdev->sfp_bus = NULL;
		if (bus->registered) {
		if (bus->started)
		bus->socket_ops->stop(bus->sfp);
		@@ -438,7 +440,6 @@ static void sfp_upstream_clear(struct sfp_bus *bus)
		{
		bus->upstream_ops = NULL;
		bus->upstream = NULL;
		bus->netdev->sfp_bus = NULL;
		bus->netdev = NULL;
		}

		@@ -467,7 +468,6 @@ struct sfp_bus sfp_register_upstream(struct fwnode_handle fwnode,
		bus->upstream_ops = ops;
		bus->upstream = upstream;
		bus->netdev = ndev;
		ndev->sfp_bus = bus;

		if (bus->sfp) {
		ret = sfp_register_bus(bus);