linux/drivers/net
Lukas Wunner bc945ca496 usbnet: smsc95xx: Avoid link settings race on interrupt reception
[ Upstream commit 8960f878e3 ]

When a PHY interrupt is signaled, the SMSC LAN95xx driver updates the
MAC full duplex mode and PHY flow control registers based on cached data
in struct phy_device:

  smsc95xx_status()                 # raises EVENT_LINK_RESET
    usbnet_deferred_kevent()
      smsc95xx_link_reset()         # uses cached data in phydev

Simultaneously, phylib polls link status once per second and updates
that cached data:

  phy_state_machine()
    phy_check_link_status()
      phy_read_status()
        lan87xx_read_status()
          genphy_read_status()      # updates cached data in phydev

If smsc95xx_link_reset() wins the race against genphy_read_status(),
the registers may be updated based on stale data.

E.g. if the link was previously down, phydev->duplex is set to
DUPLEX_UNKNOWN and that's what smsc95xx_link_reset() will use, even
though genphy_read_status() may update it to DUPLEX_FULL afterwards.

PHY interrupts are currently only enabled on suspend to trigger wakeup,
so the impact of the race is limited, but we're about to enable them
perpetually.

Avoid the race by delaying execution of smsc95xx_link_reset() until
phy_state_machine() has done its job and calls back via
smsc95xx_handle_link_change().

Signaling EVENT_LINK_RESET on wakeup is not necessary because phylib
picks up link status changes through polling.  So drop the declaration
of a ->link_reset() callback.

Note that the semicolon on a line by itself added in smsc95xx_status()
is a placeholder for a function call which will be added in a subsequent
commit.  That function call will actually handle the INT_ENP_PHY_INT_
interrupt.

Tested-by: Oleksij Rempel <o.rempel@pengutronix.de> # LAN9514/9512/9500
Tested-by: Ferry Toth <fntoth@gmail.com> # LAN9514
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-08-21 15:16:17 +02:00
..
appletalk
arcnet net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() 2022-03-08 19:09:35 +01:00
bonding net: bonding: fix use-after-free after 802.3ad slave unbind 2022-07-07 17:52:18 +02:00
caif caif_virtio: fix race between virtio_device_ready() and ndo_open() 2022-07-07 17:52:18 +02:00
can can: pch_can: pch_can_error(): initialize errc before using it 2022-08-21 15:15:49 +02:00
dsa net: dsa: bcm_sf2: force pause link settings 2022-07-07 17:52:16 +02:00
ethernet net: ionic: fix error check for vlan flags in ionic_set_nic_features() 2022-08-21 15:15:51 +02:00
fddi
fjes fjes: Check for error irq 2021-12-29 12:25:57 +01:00
hamradio hamradio: remove needs_free_netdev to avoid UAF 2022-04-20 09:23:09 +02:00
hippi drivers: net: hippi: Fix deadlock in rr_close() 2022-05-09 09:05:06 +02:00
hyperv hv_netvsc: Fix potential dereference of NULL pointer 2022-06-09 10:21:12 +02:00
ieee802154 net: ieee802154: ca8210: Fix lifs/sifs periods 2022-02-23 12:01:02 +01:00
ipa net: ipa: fix page free in ipa_endpoint_replenish_one() 2022-06-09 10:21:29 +02:00
ipvlan
mdio net: mdio: Alphabetically sort header inclusion 2022-04-20 09:23:12 +02:00
netdevsim netdevsim: Avoid allocation warnings triggered from user space 2022-08-21 15:15:51 +02:00
pcs
phy net: sfp: fix memory leak in sfp_probe() 2022-07-21 21:20:15 +02:00
plip
ppp ppp: ensure minimum packet size in ppp_write() 2022-01-27 10:54:01 +01:00
slip drivers: net: slip: fix NPD bug in sl_tx_timeout() 2022-04-20 09:23:24 +02:00
team
usb usbnet: smsc95xx: Avoid link settings race on interrupt reception 2022-08-21 15:16:17 +02:00
vmxnet3 net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cleanup() 2022-05-25 09:17:58 +02:00
wan
wimax
wireguard wireguard: allowedips: don't corrupt stack when detecting overflow 2022-08-21 15:15:52 +02:00
wireless mwifiex: fix sleep in atomic context bugs caused by dev_coredumpv 2022-08-21 15:15:55 +02:00
xen-netback xen/netback: avoid entering xenvif_rx_next_skb() with an empty rx queue 2022-07-21 21:19:59 +02:00
bareudp.c bareudp: use ipv6_mod_enabled to check if IPv6 enabled 2022-04-08 14:40:22 +02:00
dummy.c
eql.c
geneve.c
gtp.c
ifb.c ifb: fix building without CONFIG_NET_CLS_ACT 2021-11-18 14:03:49 +01:00
Kconfig lib/crypto: blake2s: include as built-in 2022-05-30 09:33:26 +02:00
LICENSE.SRC
loopback.c
macsec.c net: macsec: fix potential resource leak in macsec_add_rxsa() and macsec_add_txsa() 2022-08-03 12:00:48 +02:00
macvlan.c
macvtap.c macvtap: advertise link netns via netlink 2022-04-13 21:00:59 +02:00
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c net: sungem_phy: Add of_node_put() for reference returned by of_get_parent() 2022-08-03 12:00:46 +02:00
tap.c tuntap: add sanity checks about msg_controllen in sendmsg 2022-04-13 21:00:59 +02:00
thunderbolt.c
tun.c tun: avoid double free in tun_free_netdev 2022-08-11 13:06:44 +02:00
veth.c veth: Ensure eth header is in skb's linear part 2022-04-20 09:23:11 +02:00
virtio_net.c virtio-net: fix the race between refill work and close 2022-08-03 12:00:49 +02:00
vrf.c vrf: don't run conntrack on vrf with !dflt qdisc 2021-12-14 11:32:36 +01:00
vsockmon.c
vxlan.c vxlan: fix error return code in vxlan_fdb_append 2022-04-27 13:53:53 +02:00
xen-netfront.c xen-netfront: restore __skb_queue_tail() positioning in xennet_get_responses() 2022-07-07 17:52:23 +02:00