Skip to content

Commit 015c5d5

Browse files
shimodaydavem330
authored andcommitted
net: ethernet: ravb: exit if re-initialization fails in tx timeout
According to the report of [1], this driver is possible to cause the following error in ravb_tx_timeout_work(). ravb e6800000.ethernet ethernet: failed to switch device to config mode This error means that the hardware could not change the state from "Operation" to "Configuration" while some tx and/or rx queue are operating. After that, ravb_config() in ravb_dmac_init() will fail, and then any descriptors will be not allocaled anymore so that NULL pointer dereference happens after that on ravb_start_xmit(). To fix the issue, the ravb_tx_timeout_work() should check the return values of ravb_stop_dma() and ravb_dmac_init(). If ravb_stop_dma() fails, ravb_tx_timeout_work() re-enables TX and RX and just exits. If ravb_dmac_init() fails, just exits. [1] https://lore.kernel.org/linux-renesas-soc/[email protected]/ Reported-by: Dirk Behme <[email protected]> Signed-off-by: Yoshihiro Shimoda <[email protected]> Reviewed-by: Sergei Shtylyov <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent ca67323 commit 015c5d5

File tree

1 file changed

+24
-2
lines changed

1 file changed

+24
-2
lines changed

drivers/net/ethernet/renesas/ravb_main.c

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1450,6 +1450,7 @@ static void ravb_tx_timeout_work(struct work_struct *work)
14501450
struct ravb_private *priv = container_of(work, struct ravb_private,
14511451
work);
14521452
struct net_device *ndev = priv->ndev;
1453+
int error;
14531454

14541455
netif_tx_stop_all_queues(ndev);
14551456

@@ -1458,15 +1459,36 @@ static void ravb_tx_timeout_work(struct work_struct *work)
14581459
ravb_ptp_stop(ndev);
14591460

14601461
/* Wait for DMA stopping */
1461-
ravb_stop_dma(ndev);
1462+
if (ravb_stop_dma(ndev)) {
1463+
/* If ravb_stop_dma() fails, the hardware is still operating
1464+
* for TX and/or RX. So, this should not call the following
1465+
* functions because ravb_dmac_init() is possible to fail too.
1466+
* Also, this should not retry ravb_stop_dma() again and again
1467+
* here because it's possible to wait forever. So, this just
1468+
* re-enables the TX and RX and skip the following
1469+
* re-initialization procedure.
1470+
*/
1471+
ravb_rcv_snd_enable(ndev);
1472+
goto out;
1473+
}
14621474

14631475
ravb_ring_free(ndev, RAVB_BE);
14641476
ravb_ring_free(ndev, RAVB_NC);
14651477

14661478
/* Device init */
1467-
ravb_dmac_init(ndev);
1479+
error = ravb_dmac_init(ndev);
1480+
if (error) {
1481+
/* If ravb_dmac_init() fails, descriptors are freed. So, this
1482+
* should return here to avoid re-enabling the TX and RX in
1483+
* ravb_emac_init().
1484+
*/
1485+
netdev_err(ndev, "%s: ravb_dmac_init() failed, error %d\n",
1486+
__func__, error);
1487+
return;
1488+
}
14681489
ravb_emac_init(ndev);
14691490

1491+
out:
14701492
/* Initialise PTP Clock driver */
14711493
if (priv->chip_id == RCAR_GEN2)
14721494
ravb_ptp_init(ndev, priv->pdev);

0 commit comments

Comments
 (0)