leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

sh_eth: Fix ethtool operation crash when net device is down

Browse Source 
The driver connects and disconnects the PHY device whenever the
net device is brought up and down.  The ethtool get_settings,
set_settings and nway_reset operations will dereference a null
or dangling pointer if called while it is down.

I think it would be preferable to keep the PHY connected, but there
may be good reasons not to.

As an immediate fix for this bug:
- Set the phydev pointer to NULL after disconnecting the PHY
- Change those three operations to return -ENODEV while the PHY is
  not connected

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ben Hutchings 2015-01-16 17:51:25 +00:00 committed by David S. Miller
parent b37feed7c2
commit 4f9dce230b
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/ethernet/renesas/sh_eth.c
View File

@ -1827,6 +1827,9 @@ static int sh_eth_get_settings(struct net_device *ndev,
unsigned long flags;
int ret;
if (!mdp->phydev)
return -ENODEV;
spin_lock_irqsave(&mdp->lock, flags);
ret = phy_ethtool_gset(mdp->phydev, ecmd);
spin_unlock_irqrestore(&mdp->lock, flags);
@ -1841,6 +1844,9 @@ static int sh_eth_set_settings(struct net_device *ndev,
unsigned long flags;
int ret;
if (!mdp->phydev)
return -ENODEV;
spin_lock_irqsave(&mdp->lock, flags);
/* disable tx and rx */
@ -1875,6 +1881,9 @@ static int sh_eth_nway_reset(struct net_device *ndev)
unsigned long flags;
int ret;
if (!mdp->phydev)
return -ENODEV;
spin_lock_irqsave(&mdp->lock, flags);
ret = phy_start_aneg(mdp->phydev);
spin_unlock_irqrestore(&mdp->lock, flags);
@ -2184,6 +2193,7 @@ static int sh_eth_close(struct net_device *ndev)
if (mdp->phydev) {
phy_stop(mdp->phydev);
phy_disconnect(mdp->phydev);
mdp->phydev = NULL;
}
free_irq(ndev->irq, ndev);