Re: Crash due to fbca164776e438 - "net: stmmac: Use the right logging function in stmmac_mdio_register"

[Florian Fainelli]

On 08/22/2017 11:47 AM, Priit Laes wrote:
> Hi!
> 
> I'm running into following crash during boot on Cubietruck A20, with the patch
> fbca164776e438
> (net: stmmac: Use the right logging function in stmmac_mdio_register) applied:
> 
> [snip]
> sun7i-dwmac 1c50000.ethernet: PTP uses main clock
> sun7i-dwmac 1c50000.ethernet: no reset control found
> sun7i-dwmac 1c50000.ethernet: no regulator found
> sun7i-dwmac 1c50000.ethernet: Ring mode enabled
> sun7i-dwmac 1c50000.ethernet: DMA HW capability register supported
> sun7i-dwmac 1c50000.ethernet: Normal descriptors
> libphy: stmmac: probed
> Unable to handle kernel NULL pointer dereference at virtual address 00000048

Yes indeed:

(gdb) p/x (int)&((struct phy_driver *)0)->name
$2 = 0x48

The following should fix it:

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9493fb369682..810f6fd2f639 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -877,15 +877,17 @@ EXPORT_SYMBOL(phy_attached_info);
 #define ATTACHED_FMT "attached PHY driver [%s] (mii_bus:phy_addr=%s,
irq=%d)"
 void phy_attached_print(struct phy_device *phydev, const char *fmt, ...)
 {
+       const char *drv_name = phydev->drv ? phydev->drv->name : "unbound";
+
        if (!fmt) {
                dev_info(&phydev->mdio.dev, ATTACHED_FMT "\n",
-                        phydev->drv->name, phydev_name(phydev),
+                        drv_name, phydev_name(phydev),
                         phydev->irq);
        } else {
                va_list ap;

                dev_info(&phydev->mdio.dev, ATTACHED_FMT,
-                        phydev->drv->name, phydev_name(phydev),
+                        drv_name, phydev_name(phydev),
                         phydev->irq);

                va_start(ap, fmt);



> pgd = c0004000
> [00000048] *pgd=00000000
> Internal error: Oops: 5 [#1] SMP ARM
> Modules linked in:
> CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.13.0-rc6-00318-g0065bd7fa384 #1
> Hardware name: Allwinner sun7i (A20) Family
> task: ee868000 task.stack: ee85c000
> PC is at phy_attached_print+0x1c/0x8c
> LR is at stmmac_mdio_register+0x12c/0x200
> pc : [<c04510ac>]    lr : [<c045e6b4>]    psr: 60000013
> sp : ee85ddc8  ip : 00000000  fp : c07dfb5c
> r10: ee981210  r9 : 00000001  r8 : eea73000
> r7 : eeaa6dd0  r6 : eeb49800  r5 : 00000000  r4 : 00000000
> r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : eeb49800
> Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
> Control: 10c5387d  Table: 4000406a  DAC: 00000051
> Process swapper/0 (pid: 1, stack limit = 0xee85c210)
> Stack: (0xee85ddc8 to 0xee85e000)
> ddc0:                   00000000 00000002 eeb49400 eea72000 00000000 eeb49400
> dde0: c045e6b4 00000000 ffffffff eeab0810 00000000 c08051f8 ee9292c0 c016d480
> de00: eea725c0 eea73000 eea72000 00000001 eea726c0 c0457d0c 00000040 00000020
> de20: 00000000 c045b850 00000001 00000000 ee981200 eeab0810 eeaa6ed0 ee981210
> de40: 00000000 c094a4a0 00000000 c0465180 eeaa7550 f08d0000 c9ffb90c 00000032
> de60: fffffffa 00000032 ee981210 ffffffed c0a46620 fffffdfb c0a46620 c03f7be8
> de80: ee981210 c0a9a388 00000000 00000000 c0a46620 c03f63e0 ee981210 c0a46620
> dea0: ee981244 00000000 00000007 000000c6 c094a4a0 c03f6534 00000000 c0a46620
> dec0: c03f6490 c03f49ec ee828a58 ee9217b4 c0a46620 eeaa4b00 c0a43230 c03f59fc
> dee0: c08051f8 c094a49c c0a46620 c0a46620 00000000 c091c668 c093783c c03f6dfc
> df00: ffffe000 00000000 c091c668 c010177c eefe0938 eefe0935 c085e200 000000c6
> df20: 00000005 c0136bc8 60000013 c080b3a4 00000006 00000006 c07ce7b4 00000000
> df40: c07d7ddc c07cef28 eefe0938 eefe093e c0a0b2f0 c0a641c0 c0a641c0 c0a641c0
> df60: c0937834 00000007 000000c6 c094a4a0 00000000 c0900d88 00000006 00000006
> df80: 00000000 c09005a8 00000000 c060ecf4 00000000 00000000 00000000 00000000
> dfa0: 00000000 c060ecfc 00000000 c0107738 00000000 00000000 00000000 00000000
> dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
> dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffdeffff ffffffff
> [<c04510ac>] (phy_attached_print) from [<c045e6b4>] (stmmac_mdio_register+0x12c/0x200)
> [<c045e6b4>] (stmmac_mdio_register) from [<c045b850>] (stmmac_dvr_probe+0x850/0x96c)
> [<c045b850>] (stmmac_dvr_probe) from [<c0465180>] (sun7i_gmac_probe+0x120/0x180)
> [<c0465180>] (sun7i_gmac_probe) from [<c03f7be8>] (platform_drv_probe+0x50/0xac)
> [<c03f7be8>] (platform_drv_probe) from [<c03f63e0>] (driver_probe_device+0x234/0x2e4)
> [<c03f63e0>] (driver_probe_device) from [<c03f6534>] (__driver_attach+0xa4/0xa8)
> [<c03f6534>] (__driver_attach) from [<c03f49ec>] (bus_for_each_dev+0x4c/0x9c)
> [<c03f49ec>] (bus_for_each_dev) from [<c03f59fc>] (bus_add_driver+0x190/0x214)
> [<c03f59fc>] (bus_add_driver) from [<c03f6dfc>] (driver_register+0x78/0xf4)
> [<c03f6dfc>] (driver_register) from [<c010177c>] (do_one_initcall+0x44/0x168)
> [<c010177c>] (do_one_initcall) from [<c0900d88>] (kernel_init_freeable+0x144/0x1d0)
> [<c0900d88>] (kernel_init_freeable) from [<c060ecfc>] (kernel_init+0x8/0x110)
> [<c060ecfc>] (kernel_init) from [<c0107738>] (ret_from_fork+0x14/0x3c)
> Code: e59021c8 e59d401c e590302c e3540000 (e5922048) 
> ---[ end trace 39ae87c7923562d0 ]---
> Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
> [/snip]
> 
> After reverting said patch, there are no issues.
> 
> PÃikest,
> Priit Laes
> 


-- 
Florian