From patchwork Tue Mar 6 15:00:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeremy Linton X-Patchwork-Id: 130816 Delivered-To: patch@linaro.org Received: by 10.46.66.2 with SMTP id p2csp4037113lja; Tue, 6 Mar 2018 07:00:28 -0800 (PST) X-Google-Smtp-Source: AG47ELs0qw7EvdNzNRIA04TloFEdpTLQlvqXTjshGktzS/UU4skWfjOkMgUvmlSo3jdzLcyIQrwF X-Received: by 2002:a17:902:128c:: with SMTP id g12-v6mr17048083pla.85.1520348428708; Tue, 06 Mar 2018 07:00:28 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520348428; cv=none; d=google.com; s=arc-20160816; b=bh6mjkBqfecdqPsVMKAvVswfzJMsptV2RC1CA4uAx0Mq7gYZj7N1rkdUAdipTsGyjH aDu4eSyhLGifWnSNGrIPNKUDT6MpnDNmhgq4yKDpHaBonc/36wSXDZulAQh4g9Xqt/IP 3/d8ZW1FFNAZB0rvqV5SFLJFoI8JKBiq4pZTQ19jDSP+3r4ijVMvtCDHuezs+HCzxmgn Ghu13+G3j8ToCg92pCOKyeASIiSUOq1VibXbTeOwK3OJluA5ULHKxBifOatmvb6IuPKI tdyVVhh57hlXZ8owtOlNbrSxMIt+XDFmeTVvYgFhpX4rjNI7dXf4q84RvHhFKWptbXeR /08Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :arc-authentication-results; bh=qzsoVSh6qv9B6g2iB4UxMgW5/4Axh4i/usNXn9JHc7E=; b=uCpCXiHyOzOS65M1kHsrRpnFryZs9mkl1EQjEUB3O3GTTrnMFpMQmoj5G0I+IjYz7V 6qKkIlz4raIN86khpkTLy9LtyFoYzYoCpc6CXzaoUSI0E/uwc3iFZ9UiqXI372ZdDZT8 Zq7T9z7Q0Ypr8ijro7+XCtrTU34/AhD3xpdFE0z2PTeiqJLOZLCVjAm5/teoVjJ9jRFu e+DTgKLppNDjd1B+9BLktEt27U+aiDnqJeOjpJWWO82BRBLqpvZpwZ2cHDxXuUtVIuSf bWmANlPeuKJezezsuudE8Puunp7RhYSTR34UjXrCv4hVHl0yy8EZxAsbyOpdxN5CBXly tK6w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h62si9933824pgc.723.2018.03.06.07.00.28; Tue, 06 Mar 2018 07:00:28 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933031AbeCFPAZ (ORCPT + 28 others); Tue, 6 Mar 2018 10:00:25 -0500 Received: from foss.arm.com ([217.140.101.70]:39796 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932537AbeCFPAY (ORCPT ); Tue, 6 Mar 2018 10:00:24 -0500 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id C155214; Tue, 6 Mar 2018 07:00:23 -0800 (PST) Received: from beelzebub.austin.arm.com (beelzebub.austin.arm.com [10.118.12.119]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 6DE633F53D; Tue, 6 Mar 2018 07:00:23 -0800 (PST) From: Jeremy Linton To: netdev@vger.kernel.org Cc: steve.glendinning@shawell.net, matt.sealey@arm.com, davem@davemloft.net, linux-kernel@vger.kernel.org, Jeremy Linton Subject: [PATCH] net: smsc911x: Fix unload crash when link is up Date: Tue, 6 Mar 2018 09:00:06 -0600 Message-Id: <20180306150006.31512-1-jeremy.linton@arm.com> X-Mailer: git-send-email 2.13.6 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The smsc911x driver will crash if it is rmmod'ed while the netdev is up like: Call trace: phy_detach+0x94/0x150 phy_disconnect+0x40/0x50 smsc911x_stop+0x104/0x128 [smsc911x] __dev_close_many+0xb4/0x138 dev_close_many+0xbc/0x190 rollback_registered_many+0x140/0x460 rollback_registered+0x68/0xb0 unregister_netdevice_queue+0x100/0x118 unregister_netdev+0x28/0x38 smsc911x_drv_remove+0x58/0x130 [smsc911x] platform_drv_remove+0x30/0x50 device_release_driver_internal+0x15c/0x1f8 driver_detach+0x54/0x98 bus_remove_driver+0x64/0xe8 driver_unregister+0x34/0x60 platform_driver_unregister+0x20/0x30 smsc911x_cleanup_module+0x14/0xbca8 [smsc911x] SyS_delete_module+0x1e8/0x238 __sys_trace_return+0x0/0x4 This is caused by the mdiobus being unregistered/free'd and the code in phy_detach() attempting to manipulate mdio related structures from unregister_netdev() calling close() To fix this, we delay the mdiobus teardown until after the netdev is deregistered. Reported-by: Matt Sealey Signed-off-by: Jeremy Linton --- drivers/net/ethernet/smsc/smsc911x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.13.6 Reviewed-by: Andrew Lunn diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c index 012fb66eed8d..f0afb88d7bc2 100644 --- a/drivers/net/ethernet/smsc/smsc911x.c +++ b/drivers/net/ethernet/smsc/smsc911x.c @@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev) pdata = netdev_priv(dev); BUG_ON(!pdata); BUG_ON(!pdata->ioaddr); - WARN_ON(dev->phydev); SMSC_TRACE(pdata, ifdown, "Stopping driver"); + unregister_netdev(dev); + mdiobus_unregister(pdata->mii_bus); mdiobus_free(pdata->mii_bus); - unregister_netdev(dev); res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "smsc911x-memory"); if (!res)