Skip to content

Commit 82a44ae

Browse files
wvk86davem330
authored andcommitted
net: stmmac: fix kernel panic due to NULL pointer dereference of plat->est
In the case of taprio offload is not enabled, the error handling path causes a kernel crash due to kernel NULL pointer deference. Fix this by adding check for NULL before attempt to access 'plat->est' on the mutex_lock() call. The following kernel panic is observed without this patch: RIP: 0010:mutex_lock+0x10/0x20 Call Trace: tc_setup_taprio+0x482/0x560 [stmmac] kmem_cache_alloc_trace+0x13f/0x490 taprio_disable_offload.isra.0+0x9d/0x180 [sch_taprio] taprio_destroy+0x6c/0x100 [sch_taprio] qdisc_create+0x2e5/0x4f0 tc_modify_qdisc+0x126/0x740 rtnetlink_rcv_msg+0x12b/0x380 _raw_spin_lock_irqsave+0x19/0x40 _raw_spin_unlock_irqrestore+0x18/0x30 create_object+0x212/0x340 rtnl_calcit.isra.0+0x110/0x110 netlink_rcv_skb+0x50/0x100 netlink_unicast+0x191/0x230 netlink_sendmsg+0x243/0x470 sock_sendmsg+0x5e/0x60 ____sys_sendmsg+0x20b/0x280 copy_msghdr_from_user+0x5c/0x90 __mod_memcg_state+0x87/0xf0 ___sys_sendmsg+0x7c/0xc0 lru_cache_add+0x7f/0xa0 _raw_spin_unlock+0x16/0x30 wp_page_copy+0x449/0x890 handle_mm_fault+0x921/0xfc0 __sys_sendmsg+0x59/0xa0 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ---[ end trace b1f19b24368a96aa ]--- Fixes: b60189e ("net: stmmac: Integrate EST with TAPRIO scheduler API") Cc: <[email protected]> # 5.10.x Signed-off-by: Wong Vee Khee <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 46002bf commit 82a44ae

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

drivers/net/ethernet/stmicro/stmmac/stmmac_tc.c

+7-5
Original file line numberDiff line numberDiff line change
@@ -884,11 +884,13 @@ static int tc_setup_taprio(struct stmmac_priv *priv,
884884
return 0;
885885

886886
disable:
887-
mutex_lock(&priv->plat->est->lock);
888-
priv->plat->est->enable = false;
889-
stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
890-
priv->plat->clk_ptp_rate);
891-
mutex_unlock(&priv->plat->est->lock);
887+
if (priv->plat->est) {
888+
mutex_lock(&priv->plat->est->lock);
889+
priv->plat->est->enable = false;
890+
stmmac_est_configure(priv, priv->ioaddr, priv->plat->est,
891+
priv->plat->clk_ptp_rate);
892+
mutex_unlock(&priv->plat->est->lock);
893+
}
892894

893895
priv->plat->fpe_cfg->enable = false;
894896
stmmac_fpe_configure(priv, priv->ioaddr,

0 commit comments

Comments
 (0)