[5.17,100/114] net: phy: Fix race condition on link status change

From: Francesco Dolcini <francesco.dolcini@toradex.com>

From: Francesco Dolcini <francesco.dolcini@toradex.com>

commit 91a7cda1f4b8bdf770000a3b60640576dafe0cec upstream.

This fixes the following error caused by a race condition between
phydev->adjust_link() and a MDIO transaction in the phy interrupt
handler. The issue was reproduced with the ethernet FEC driver and a
micrel KSZ9031 phy.

[  146.195696] fec 2188000.ethernet eth0: MDIO read timeout
[  146.201779] ------------[ cut here ]------------
[  146.206671] WARNING: CPU: 0 PID: 571 at drivers/net/phy/phy.c:942 phy_error+0x24/0x6c
[  146.214744] Modules linked in: bnep imx_vdoa imx_sdma evbug
[  146.220640] CPU: 0 PID: 571 Comm: irq/128-2188000 Not tainted 5.18.0-rc3-00080-gd569e86915b7 #9
[  146.229563] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree)
[  146.236257]  unwind_backtrace from show_stack+0x10/0x14
[  146.241640]  show_stack from dump_stack_lvl+0x58/0x70
[  146.246841]  dump_stack_lvl from __warn+0xb4/0x24c
[  146.251772]  __warn from warn_slowpath_fmt+0x5c/0xd4
[  146.256873]  warn_slowpath_fmt from phy_error+0x24/0x6c
[  146.262249]  phy_error from kszphy_handle_interrupt+0x40/0x48
[  146.268159]  kszphy_handle_interrupt from irq_thread_fn+0x1c/0x78
[  146.274417]  irq_thread_fn from irq_thread+0xf0/0x1dc
[  146.279605]  irq_thread from kthread+0xe4/0x104
[  146.284267]  kthread from ret_from_fork+0x14/0x28
[  146.289164] Exception stack(0xe6fa1fb0 to 0xe6fa1ff8)
[  146.294448] 1fa0:                                     00000000 00000000 00000000 00000000
[  146.302842] 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  146.311281] 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000
[  146.318262] irq event stamp: 12325
[  146.321780] hardirqs last  enabled at (12333): [<c01984c4>] __up_console_sem+0x50/0x60
[  146.330013] hardirqs last disabled at (12342): [<c01984b0>] __up_console_sem+0x3c/0x60
[  146.338259] softirqs last  enabled at (12324): [<c01017f0>] __do_softirq+0x2c0/0x624
[  146.346311] softirqs last disabled at (12319): [<c01300ac>] __irq_exit_rcu+0x138/0x178
[  146.354447] ---[ end trace 0000000000000000 ]---

With the FEC driver phydev->adjust_link() calls fec_enet_adjust_link()
calls fec_stop()/fec_restart() and both these function reset and
temporary disable the FEC disrupting any MII transaction that
could be happening at the same time.

fec_enet_adjust_link() and phy_read() can be running at the same time
when we have one additional interrupt before the phy_state_machine() is
able to terminate.

Thread 1 (phylib WQ)       | Thread 2 (phy interrupt)
                           |
                           | phy_interrupt()            <-- PHY IRQ
                           |  handle_interrupt()
                           |   phy_read()
                           |   phy_trigger_machine()
                           |    --> schedule phylib WQ
                           |
                           |
phy_state_machine()        |
 phy_check_link_status()   |
  phy_link_change()        |
   phydev->adjust_link()   |
    fec_enet_adjust_link() |
     --> FEC reset         | phy_interrupt()            <-- PHY IRQ
                           |  phy_read()
                           |

Fix this by acquiring the phydev lock in phy_interrupt().

Link: https://lore.kernel.org/all/20220422152612.GA510015@francesco-nb.int.toradex.com/
Fixes: c974bdbc3e77 ("net: phy: Use threaded IRQ, to allow IRQ from sleeping devices")
cc: <stable@vger.kernel.org>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20220506060815.327382-1-francesco.dolcini@toradex.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/phy/phy.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

Message ID	20220516193628.348428146@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7D24C38A04 for <stable@archiver.kernel.org>; Mon, 16 May 2022 20:13:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346661AbiEPULq (ORCPT <rfc822;stable@archiver.kernel.org>); Mon, 16 May 2022 16:11:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51606 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1351074AbiEPUB6 (ORCPT <rfc822;stable@vger.kernel.org>); Mon, 16 May 2022 16:01:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28F0C3FDBE; Mon, 16 May 2022 12:58:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DC328B81615; Mon, 16 May 2022 19:58:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23EDBC385AA; Mon, 16 May 2022 19:58:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1652731092; bh=6rNJoLS/Ojh91LhmB/MjVAf98QJkadN8ugt+pWo3vKo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LKLGEqM67XboC17UF9U0QXB7Ky8jXaQBBZ7pyLgEbszHdgRBBJlHGYQu5DKr6NkYt PMc3NZl7FcB2ojCzWRa4Kg34MU4CTdZDe0m1jjQS9SGMSoLUtwLsrdvhBprUGyh8NU pZX+o//esFXc1ye5Doj2L9mBgI7TNoP6JBVm49u8= From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Francesco Dolcini <francesco.dolcini@toradex.com>, Andrew Lunn <andrew@lunn.ch>, Jakub Kicinski <kuba@kernel.org> Subject: [PATCH 5.17 100/114] net: phy: Fix race condition on link status change Date: Mon, 16 May 2022 21:37:14 +0200 Message-Id: <20220516193628.348428146@linuxfoundation.org> X-Mailer: git-send-email 2.36.1 In-Reply-To: <20220516193625.489108457@linuxfoundation.org> References: <20220516193625.489108457@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: <stable.vger.kernel.org> X-Mailing-List: stable@vger.kernel.org
Series	None \| expand [5.17,002/114] iwlwifi: iwl-dbg: Use del_timer_sync() before freeing [5.17,003/114] hwmon: (tmp401) Add OF device ID table [5.17,004/114] mac80211: Reset MBSSID parameters upon connection [5.17,005/114] net: rds: use maybe_get_net() when acquiring refcount on TCP sockets [5.17,006/114] net: Fix features skip in for_each_netdev_feature() [5.17,007/114] net: mscc: ocelot: fix last VCAP IS1/IS2 filter persisting in hardware when deleted [5.17,008/114] net: mscc: ocelot: fix VCAP IS2 filters matching on both lookups [5.17,009/114] net: mscc: ocelot: restrict tc-trap actions to VCAP IS2 lookup 0 [5.17,010/114] net: mscc: ocelot: avoid corrupting hardware counters when moving VCAP filters [5.17,011/114] fbdev: simplefb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,012/114] fbdev: efifb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,013/114] fbdev: vesafb: Cleanup fb_info in .fb_destroy rather than .remove [5.17,014/114] platform/surface: aggregator: Fix initialization order when compiling as builtin m... [5.17,015/114] ice: Fix race during aux device (un)plugging [5.17,016/114] ice: clear stale Tx queue settings before configuring [5.17,017/114] ice: fix PTP stale Tx timestamps cleanup [5.17,018/114] ipv4: drop dst in multicast routing path [5.17,019/114] drm/nouveau: Fix a potential theorical leak in nouveau_get_backlight_name() [5.17,020/114] netlink: do not reset transport header in netlink_recvmsg() [5.17,021/114] net: chelsio: cxgb4: Avoid potential negative array offset [5.17,022/114] fbdev: efifb: Fix a use-after-free due early fb_info cleanup [5.17,023/114] net: sfc: fix memory leak due to ptp channel [5.17,024/114] fanotify: do not allow setting dirent events in mask of non-dir [5.17,025/114] mac80211_hwsim: call ieee80211_tx_prepare_skb under RCU protection [5.17,026/114] nfs: fix broken handling of the softreval mount option [5.17,027/114] ionic: fix missing pci_release_regions() on error in ionic_probe() [5.17,028/114] dim: initialize all struct fields [5.17,029/114] hwmon: (ltq-cputemp) restrict it to SOC_XWAY [5.17,030/114] procfs: prevent unprivileged processes accessing fdinfo dir [5.17,031/114] selftests: vm: Makefile: rename TARGETS to VMTARGETS [5.17,032/114] net: dsa: flush switchdev workqueue on bridge join error path [5.17,033/114] arm64: vdso: fix makefile dependency on vdso.so [5.17,034/114] virtio: fix virtio transitional ids [5.17,035/114] s390/ctcm: fix variable dereferenced before check [5.17,036/114] s390/ctcm: fix potential memory leak [5.17,037/114] s390/lcs: fix variable dereferenced before check [5.17,038/114] net/sched: act_pedit: really ensure the skb is writable [5.17,039/114] net: ethernet: mediatek: ppe: fix wrong size passed to memset() [5.17,040/114] net: bcmgenet: Check for Wake-on-LAN interrupt probe deferral [5.17,041/114] drm/vc4: hdmi: Fix build error for implicit function declaration [5.17,042/114] mlxsw: Avoid warning during ip6gre device removal [5.17,043/114] net: dsa: bcm_sf2: Fix Wake-on-LAN with mac_link_down() [5.17,044/114] net/smc: non blocking recvmsg() return -EAGAIN when no data and signal_pending [5.17,045/114] net: sfc: ef10: fix memory leak in efx_ef10_mtd_probe() [5.17,046/114] tls: Fix context leak on tls_device_down [5.17,047/114] drm/vmwgfx: Fix fencing on SVGAv3 [5.17,048/114] gfs2: Fix filesystem block deallocation for short writes [5.17,049/114] hwmon: (asus_wmi_sensors) Fix CROSSHAIR VI HERO name [5.17,050/114] hwmon: (f71882fg) Fix negative temperature [5.17,051/114] RDMA/irdma: Fix deadlock in irdma_cleanup_cm_core() [5.17,052/114] iommu: arm-smmu: disable large page mappings for Nvidia arm-smmu [5.17,053/114] ASoC: max98090: Reject invalid values in custom control put() [5.17,054/114] ASoC: max98090: Generate notifications on changes for custom control [5.17,055/114] ASoC: ops: Validate input values in snd_soc_put_volsw_range() [5.17,056/114] s390: disable -Warray-bounds [5.17,057/114] ASoC: SOF: Fix NULL pointer exception in sof_pci_probe callback [5.17,058/114] io_uring: assign non-fixed early for async work [5.17,059/114] net: emaclite: Dont advertise 1000BASE-T and do auto negotiation [5.17,060/114] net: sfp: Add tx-fault workaround for Huawei MA5671A SFP ONT [5.17,061/114] secure_seq: use the 64 bits of the siphash for port offset calculation [5.17,062/114] tcp: use different parts of the port_offset for index and offset [5.17,063/114] tcp: resalt the secret every 10 seconds [5.17,064/114] tcp: add small random increments to the source port [5.17,065/114] tcp: dynamically allocate the perturb table used by source ports [5.17,066/114] tcp: increase source port perturb table to 2^16 [5.17,067/114] tcp: drop the hash_32() part from the index calculation [5.17,068/114] block: Do not call folio_next() on an unreferenced folio [5.17,069/114] interconnect: Restore sync state by ignoring ipa-virt in provider count [5.17,070/114] perf tests: Fix coresight `perf test` failure. [5.17,071/114] firmware_loader: use kernel credentials when reading firmware [5.17,072/114] KVM: PPC: Book3S PR: Enable MSR_DR for switch_mmu_context() [5.17,073/114] usb: xhci-mtk: fix fs isocs transfer error [5.17,074/114] x86/mm: Fix marking of unused sub-pmd ranges [5.17,075/114] tty/serial: digicolor: fix possible null-ptr-deref in digicolor_uart_probe() [5.17,076/114] tty: n_gsm: fix buffer over-read in gsm_dlci_data() [5.17,077/114] tty: n_gsm: fix mux activation issues in gsm_config() [5.17,078/114] tty: n_gsm: fix invalid gsmtty_write_room() result [5.17,079/114] usb: gadget: uvc: allow for application to cleanly shutdown [5.17,080/114] usb: cdc-wdm: fix reading stuck on device close [5.17,081/114] usb: typec: tcpci: Dont skip cleanup in .remove() on error [5.17,082/114] usb: typec: tcpci_mt6360: Update for BMC PHY setting [5.17,083/114] USB: serial: pl2303: add device id for HP LM930 Display [5.17,084/114] USB: serial: qcserial: add support for Sierra Wireless EM7590 [5.17,085/114] USB: serial: option: add Fibocom L610 modem [5.17,086/114] USB: serial: option: add Fibocom MA510 modem [5.17,087/114] slimbus: qcom: Fix IRQ check in qcom_slim_probe [5.17,088/114] fsl_lpuart: Dont enable interrupts too early [5.17,089/114] genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq() [5.17,090/114] serial: 8250_mtk: Fix UART_EFR register address [5.17,091/114] serial: 8250_mtk: Fix register address for XON/XOFF character [5.17,092/114] ceph: fix setting of xattrs on async created inodes [5.17,093/114] Revert "mm/memory-failure.c: skip huge_zero_page in memory_failure()" [5.17,094/114] mm/huge_memory: do not overkill when splitting huge_zero_page [5.17,095/114] mm: mremap: fix sign for EFAULT error return value [5.17,096/114] drm/vmwgfx: Disable command buffers on svga3 without gbobjects [5.17,097/114] drm/nouveau/tegra: Stop using iommu_present() [5.17,098/114] i40e: i40e_main: fix a missing check on list iterator [5.17,099/114] net: atlantic: always deep reset on pm op, fixing up my null deref regression [5.17,100/114] net: phy: Fix race condition on link status change [5.17,101/114] writeback: Avoid skipping inode writeback [5.17,102/114] cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp() [5.17,103/114] ping: fix address binding wrt vrf [5.17,104/114] ath11k: reduce the wait time of 11d scan and hw scan while add interface [5.17,105/114] arm[64]/memremap: dont abuse pfn_valid() to ensure presence of linear map [5.17,106/114] net: phy: micrel: Do not use kszphy_suspend/resume for KSZ8061 [5.17,107/114] net: phy: micrel: Pass .probe for KS8737 [5.17,108/114] SUNRPC: Ensure that the gssproxy client can start in a connected state [5.17,109/114] drm/vmwgfx: Initialize drm_mode_fb_cmd2 [5.17,110/114] Revert "drm/amd/pm: keep the BACO feature enabled for suspend" [5.17,111/114] dma-buf: call dma_buf_stats_setup after dmabuf is in valid list [5.17,112/114] mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() [5.17,113/114] net: phy: micrel: Fix incorrect variable type in micrel [5.17,114/114] mm/kfence: reset PG_slab and memcg_data before freeing __kfence_pool

[5.17,100/114] net: phy: Fix race condition on link status change

Commit Message

Patch