Skip to content

Commit 281e795

Browse files
committed
net: usb: asix: do not call phy_disconnect() for ax88178
jira LE-3201 cve CVE-2021-47101 Rebuild_History Non-Buildable kernel-rt-4.18.0-553.22.1.rt7.363.el8_10 commit-author Oleksij Rempel <[email protected]> commit 1406e8c Fix crash on reboot on a system with ASIX AX88178 USB adapter attached to it: | asix 1-1.4:1.0 eth0: unregister 'asix' usb-ci_hdrc.0-1.4, ASIX AX88178 USB 2.0 Ethernet | 8<--- cut here --- | Unable to handle kernel NULL pointer dereference at virtual address 0000028c | pgd = 5ec93aee | [0000028c] *pgd=00000000 | Internal error: Oops: 5 [#1] PREEMPT SMP ARM | Modules linked in: | CPU: 1 PID: 1 Comm: systemd-shutdow Not tainted 5.14.0-rc1-20210811-1 #4 | Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) | PC is at phy_disconnect+0x8/0x48 | LR is at ax88772_unbind+0x14/0x20 | [<80650d04>] (phy_disconnect) from [<80741aa4>] (ax88772_unbind+0x14/0x20) | [<80741aa4>] (ax88772_unbind) from [<8074e250>] (usbnet_disconnect+0x48/0xd8) | [<8074e250>] (usbnet_disconnect) from [<807655e0>] (usb_unbind_interface+0x78/0x25c) | [<807655e0>] (usb_unbind_interface) from [<805b03a0>] (__device_release_driver+0x154/0x20c) | [<805b03a0>] (__device_release_driver) from [<805b0478>] (device_release_driver+0x20/0x2c) | [<805b0478>] (device_release_driver) from [<805af944>] (bus_remove_device+0xcc/0xf8) | [<805af944>] (bus_remove_device) from [<805ab26c>] (device_del+0x178/0x4b0) | [<805ab26c>] (device_del) from [<807634a4>] (usb_disable_device+0xcc/0x178) | [<807634a4>] (usb_disable_device) from [<8075a060>] (usb_disconnect+0xd8/0x238) | [<8075a060>] (usb_disconnect) from [<8075a02c>] (usb_disconnect+0xa4/0x238) | [<8075a02c>] (usb_disconnect) from [<8075a02c>] (usb_disconnect+0xa4/0x238) | [<8075a02c>] (usb_disconnect) from [<80af3520>] (usb_remove_hcd+0xa0/0x198) | [<80af3520>] (usb_remove_hcd) from [<807902e0>] (host_stop+0x38/0xa8) | [<807902e0>] (host_stop) from [<8078d9e4>] (ci_hdrc_remove+0x3c/0x118) | [<8078d9e4>] (ci_hdrc_remove) from [<805b27ec>] (platform_remove+0x20/0x50) | [<805b27ec>] (platform_remove) from [<805b03a0>] (__device_release_driver+0x154/0x20c) | [<805b03a0>] (__device_release_driver) from [<805b0478>] (device_release_driver+0x20/0x2c) | [<805b0478>] (device_release_driver) from [<805af944>] (bus_remove_device+0xcc/0xf8) | [<805af944>] (bus_remove_device) from [<805ab26c>] (device_del+0x178/0x4b0) For this adapter we call ax88178_bind() and ax88772_unbind(), which is related to different chip version and different counter part *bind() function. Since this chip is currently not ported to the PHYLIB, we do not need to call phy_disconnect() here. So, to fix this crash, we need to add ax88178_unbind(). Fixes: e532a09 ("net: usb: asix: ax88772: add phylib support") Reported-by: Robin van der Gracht <[email protected]> Tested-by: Robin van der Gracht <[email protected]> Signed-off-by: Oleksij Rempel <[email protected]> Signed-off-by: David S. Miller <[email protected]> (cherry picked from commit 1406e8c) Signed-off-by: Jonathan Maple <[email protected]>
1 parent 04e0149 commit 281e795

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

drivers/net/usb/asix_devices.c

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -789,6 +789,12 @@ static void ax88772_unbind(struct usbnet *dev, struct usb_interface *intf)
789789
kfree(dev->driver_priv);
790790
}
791791

792+
static void ax88178_unbind(struct usbnet *dev, struct usb_interface *intf)
793+
{
794+
asix_rx_fixup_common_free(dev->driver_priv);
795+
kfree(dev->driver_priv);
796+
}
797+
792798
static const struct ethtool_ops ax88178_ethtool_ops = {
793799
.get_drvinfo = asix_get_drvinfo,
794800
.get_link = asix_get_link,
@@ -1199,7 +1205,7 @@ static const struct driver_info ax88772b_info = {
11991205
static const struct driver_info ax88178_info = {
12001206
.description = "ASIX AX88178 USB 2.0 Ethernet",
12011207
.bind = ax88178_bind,
1202-
.unbind = ax88772_unbind,
1208+
.unbind = ax88178_unbind,
12031209
.status = asix_status,
12041210
.link_reset = ax88178_link_reset,
12051211
.reset = ax88178_reset,

0 commit comments

Comments
 (0)