linux/drivers/net/dsa
Christian Eggers 8098bd69bc net: dsa: microchip: fix race condition
Between queuing the delayed work and finishing the setup of the dsa
ports, the process may sleep in request_module() (via
phy_device_create()) and the queued work may be executed prior to the
switch net devices being registered. In ksz_mib_read_work(), a NULL
dereference will happen within netof_carrier_ok(dp->slave).

Not queuing the delayed work in ksz_init_mib_timer() makes things even
worse because the work will now be queued for immediate execution
(instead of 2000 ms) in ksz_mac_link_down() via
dsa_port_link_register_of().

Call tree:
ksz9477_i2c_probe()
\--ksz9477_switch_register()
   \--ksz_switch_register()
      +--dsa_register_switch()
      |  \--dsa_switch_probe()
      |     \--dsa_tree_setup()
      |        \--dsa_tree_setup_switches()
      |           +--dsa_switch_setup()
      |           |  +--ksz9477_setup()
      |           |  |  \--ksz_init_mib_timer()
      |           |  |     |--/* Start the timer 2 seconds later. */
      |           |  |     \--schedule_delayed_work(&dev->mib_read, msecs_to_jiffies(2000));
      |           |  \--__mdiobus_register()
      |           |     \--mdiobus_scan()
      |           |        \--get_phy_device()
      |           |           +--get_phy_id()
      |           |           \--phy_device_create()
      |           |              |--/* sleeping, ksz_mib_read_work() can be called meanwhile */
      |           |              \--request_module()
      |           |
      |           \--dsa_port_setup()
      |              +--/* Called for non-CPU ports */
      |              +--dsa_slave_create()
      |              |  +--/* Too late, ksz_mib_read_work() may be called beforehand */
      |              |  \--port->slave = ...
      |             ...
      |              +--Called for CPU port */
      |              \--dsa_port_link_register_of()
      |                 \--ksz_mac_link_down()
      |                    +--/* mib_read must be initialized here */
      |                    +--/* work is already scheduled, so it will be executed after 2000 ms */
      |                    \--schedule_delayed_work(&dev->mib_read, 0);
      \-- /* here port->slave is setup properly, scheduling the delayed work should be safe */

Solution:
1. Do not queue (only initialize) delayed work in ksz_init_mib_timer().
2. Only queue delayed work in ksz_mac_link_down() if init is completed.
3. Queue work once in ksz_switch_register(), after dsa_register_switch()
has completed.

Fixes: 7c6ff470aa ("net: dsa: microchip: add MIB counter reading support")
Signed-off-by: Christian Eggers <ceggers@arri.de>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Reviewed-by: Vladimir Oltean <olteanv@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2020-10-12 10:00:24 -07:00
..
b53 treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
microchip net: dsa: microchip: fix race condition 2020-10-12 10:00:24 -07:00
mv88e6xxx treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
ocelot net: mscc: ocelot: warn when encoding an out-of-bounds watermark value 2020-10-06 06:05:47 -07:00
qca net: dsa/ar9331: convert to mac_link_up() 2020-06-25 16:01:15 -07:00
sja1105 net: dsa: sja1105: Do not use address of compatible member in sja1105_check_device_id 2020-08-24 16:13:25 -07:00
Kconfig net: dsa: rtl8366rb: Support the CPU DSA tag 2020-07-08 15:36:19 -07:00
Makefile net: dsa: add support for Atheros AR9331 built-in switch 2019-12-20 17:05:47 -08:00
bcm_sf2.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
bcm_sf2.h net: dsa: bcm_sf2: Add support for optional reset controller line 2019-11-05 18:06:38 -08:00
bcm_sf2_cfp.c net: dsa: bcm_sf2: Pass GENMASK() signed bits 2020-07-05 15:45:38 -07:00
bcm_sf2_regs.h Revert "net: dsa: bcm_sf2: Also configure Port 5 for 2Gb/sec on 7278" 2020-02-26 16:33:35 -08:00
dsa_loop.c net: dsa: loop: Set correct number of ports 2020-08-03 18:19:23 -07:00
dsa_loop.h
dsa_loop_bdinfo.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
lan9303-core.c net: dsa: lan9303: fix variable 'res' set but not used 2020-07-05 15:48:19 -07:00
lan9303.h
lan9303_i2c.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
lan9303_mdio.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
lantiq_gswip.c net: dsa: lantiq_gswip: fix and improve the unsupported interface error 2020-06-07 17:09:46 -07:00
lantiq_pce.h net: dsa: Use the correct style for SPDX License Identifier 2019-09-22 15:25:08 -07:00
mt7530.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-09-03 18:50:48 -07:00
mt7530.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-05-24 13:47:27 -07:00
mv88e6060.c net: dsa: Get information about stacked DSA protocol 2020-01-08 16:01:13 -08:00
mv88e6060.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
qca8k.c net: dsa: qca8k: Add 802.1q VLAN support 2020-08-03 15:45:39 -07:00
qca8k.h net: dsa: qca8k: Add 802.1q VLAN support 2020-08-03 15:45:39 -07:00
realtek-smi-core.c net: dsa: remove dsa_switch_alloc helper 2019-10-22 12:37:07 -07:00
realtek-smi-core.h net: dsa: fix warning same module names 2019-06-14 19:28:54 -07:00
rtl8366.c net: dsa: rtl8366: Properly clear member config 2020-09-06 12:32:07 -07:00
rtl8366rb.c net: dsa: rtl8366rb: Support the CPU DSA tag 2020-07-08 15:36:19 -07:00
vitesse-vsc73xx-core.c net: dsa: vsc73xx: make the MTU configurable 2020-03-27 16:07:25 -07:00
vitesse-vsc73xx-platform.c net: dsa: vitesse-vsc73xx: Convert to plain comments to avoid kerneldoc warnings 2020-07-05 15:49:03 -07:00
vitesse-vsc73xx-spi.c net: dsa: vitesse-vsc73xx: Convert to plain comments to avoid kerneldoc warnings 2020-07-05 15:49:03 -07:00
vitesse-vsc73xx.h net: dsa: vsc73xx: Split vsc73xx driver 2019-07-07 14:16:32 -07:00