Re: [PATCH] net: smsc911x: Fix unload crash when link is up

[David Miller]

From: Jeremy Linton 
Date: Tue,  6 Mar 2018 09:00:06 -0600

> The smsc911x driver will crash if it is rmmod'ed while the netdev
> is up like:
> 
> Call trace:
 ...
> This is caused by the mdiobus being unregistered/free'd
> and the code in phy_detach() attempting to manipulate mdio
> related structures from unregister_netdev() calling close()
> 
> To fix this, we delay the mdiobus teardown until after
> the netdev is deregistered.
> 
> Reported-by: Matt Sealey 
> Signed-off-by: Jeremy Linton 

Applied, thanks.

Re: [PATCH] net: smsc911x: Fix unload crash when link is up

[Jeremy Linton]

Hi,

On 03/06/2018 09:23 AM, Andrew Lunn wrote:

This is caused by the mdiobus being unregistered/free'd
and the code in phy_detach() attempting to manipulate mdio
related structures from unregister_netdev() calling close()

To fix this, we delay the mdiobus teardown until after
the netdev is deregistered.

Reported-by: Matt Sealey 
Signed-off-by: Jeremy Linton 
---
  drivers/net/ethernet/smsc/smsc911x.c | 4 ++--
  1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/smsc/smsc911x.c 
b/drivers/net/ethernet/smsc/smsc911x.c
index 012fb66eed8d..f0afb88d7bc2 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device 
*pdev)
pdata = netdev_priv(dev);
BUG_ON(!pdata);
BUG_ON(!pdata->ioaddr);
-   WARN_ON(dev->phydev);


Hi Jeremy

I assume this WARN_ON() also fired? It would be good to comment about
why you removed it, that the code now handles that case.


Yes, the phydev is started and assigned in the netdev _open and 
stopped/set to null in the _stop. Since the module remove is not blocked 
by having the netdev active, and unregister_netdev closes out active 
connections, the WARN_ON would needlessly trigger if the netdev was 
still open.




Apart from that

Reviewed-by: Andrew Lunn 


Thanks for looking at this.

Re: [PATCH] net: smsc911x: Fix unload crash when link is up

[Andrew Lunn]

> This is caused by the mdiobus being unregistered/free'd
> and the code in phy_detach() attempting to manipulate mdio
> related structures from unregister_netdev() calling close()
> 
> To fix this, we delay the mdiobus teardown until after
> the netdev is deregistered.
> 
> Reported-by: Matt Sealey 
> Signed-off-by: Jeremy Linton 
> ---
>  drivers/net/ethernet/smsc/smsc911x.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/smsc/smsc911x.c 
> b/drivers/net/ethernet/smsc/smsc911x.c
> index 012fb66eed8d..f0afb88d7bc2 100644
> --- a/drivers/net/ethernet/smsc/smsc911x.c
> +++ b/drivers/net/ethernet/smsc/smsc911x.c
> @@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device 
> *pdev)
>   pdata = netdev_priv(dev);
>   BUG_ON(!pdata);
>   BUG_ON(!pdata->ioaddr);
> - WARN_ON(dev->phydev);

Hi Jeremy

I assume this WARN_ON() also fired? It would be good to comment about
why you removed it, that the code now handles that case.

Apart from that

Reviewed-by: Andrew Lunn 

Andrew