[PATCH v2 1/2] net: eth-uclass: Fix eth_halt

From: qianfan Zhao qianfanguijin@163.com
eth_device_priv maybe unaccessable after @stop handler due to eth device is removed in @stop, touch it will trigger data abort.
Fix data abort bug when run dhcp or tftp command via usbnet.
Signed-off-by: qianfan Zhao qianfanguijin@163.com --- net/eth-uclass.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/net/eth-uclass.c b/net/eth-uclass.c index 0da0e85be0..2b88b6c145 100644 --- a/net/eth-uclass.c +++ b/net/eth-uclass.c @@ -339,8 +339,15 @@ void eth_halt(void) return;
eth_get_ops(current)->stop(current); - priv->state = ETH_STATE_PASSIVE; - priv->running = false; + + /* ethernet device maybe removed when @stop handler, that will cause + * @priv is freed. get private data again to avoid it + */ + priv = dev_get_uclass_priv(current); + if (priv) { + priv->state = ETH_STATE_PASSIVE; + priv->running = false; + } }
int eth_is_active(struct udevice *dev)

From: qianfan Zhao qianfanguijin@163.com
tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth device if it is an usb network. usbeth's private data will be unaccessable when usb_eth_free_pkt, touch it will trigger data abort.
Next is the console messages:
=> tftp xxx ... Loading: * TFTP error: 'open failed: No such file or directory' (1) Not retrying... data abort pc : [<9feb6ba2>] lr : [<9feb6b9f>]
Fix it.
Signed-off-by: qianfan Zhao qianfanguijin@163.com --- net/eth-uclass.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/net/eth-uclass.c b/net/eth-uclass.c index 2b88b6c145..c9bba4f8de 100644 --- a/net/eth-uclass.c +++ b/net/eth-uclass.c @@ -407,6 +407,13 @@ int eth_rx(void) flags = 0; if (ret > 0) net_process_received_packet(packet, ret); + + /* ethernet maybe halted when packet_handler, check again */ + if (!eth_is_active(current)) { + ret = 0; + break; + } + if (ret >= 0 && eth_get_ops(current)->free_pkt) eth_get_ops(current)->free_pkt(current, packet, ret); if (ret <= 0)

On Sat, Apr 2, 2022 at 5:58 AM qianfanguijin@163.com wrote:
From: qianfan Zhao qianfanguijin@163.com
tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth device if it is an usb network. usbeth's private data will be unaccessable when usb_eth_free_pkt, touch it will trigger data abort.
Next is the console messages:
=> tftp xxx ... Loading: * TFTP error: 'open failed: No such file or directory' (1) Not retrying... data abort pc : [<9feb6ba2>] lr : [<9feb6b9f>]
Fix it.
Signed-off-by: qianfan Zhao qianfanguijin@163.com
net/eth-uclass.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/net/eth-uclass.c b/net/eth-uclass.c index 2b88b6c145..c9bba4f8de 100644 --- a/net/eth-uclass.c +++ b/net/eth-uclass.c @@ -407,6 +407,13 @@ int eth_rx(void) flags = 0; if (ret > 0) net_process_received_packet(packet, ret);
/* ethernet maybe halted when packet_handler, check again */
if (!eth_is_active(current)) {
ret = 0;
break;
}
if (ret >= 0 && eth_get_ops(current)->free_pkt) eth_get_ops(current)->free_pkt(current, packet, ret); if (ret <= 0)
-- 2.17.1
I wonder how I never experienced this behavior. I have used USB based ethernet dongles. And I used tftp and got errors but never an abort .Is it possible that the problem is with the specific ethernet driver you are using ? Can you specify which one you used ?

在 2022/4/14 12:39, Ramon Fried 写道:
On Sat, Apr 2, 2022 at 5:58 AM qianfanguijin@163.com wrote:
From: qianfan Zhao qianfanguijin@163.com
tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth device if it is an usb network. usbeth's private data will be unaccessable when usb_eth_free_pkt, touch it will trigger data abort.
Next is the console messages:
=> tftp xxx ... Loading: * TFTP error: 'open failed: No such file or directory' (1) Not retrying... data abort pc : [<9feb6ba2>] lr : [<9feb6b9f>]
Fix it.
Signed-off-by: qianfan Zhao qianfanguijin@163.com
net/eth-uclass.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/net/eth-uclass.c b/net/eth-uclass.c index 2b88b6c145..c9bba4f8de 100644 --- a/net/eth-uclass.c +++ b/net/eth-uclass.c @@ -407,6 +407,13 @@ int eth_rx(void) flags = 0; if (ret > 0) net_process_received_packet(packet, ret);
/* ethernet maybe halted when packet_handler, check again */
if (!eth_is_active(current)) {
ret = 0;
break;
}
if (ret >= 0 && eth_get_ops(current)->free_pkt) eth_get_ops(current)->free_pkt(current, packet, ret); if (ret <= 0)
-- 2.17.1
I wonder how I never experienced this behavior. I have used USB based ethernet dongles. And I used tftp and got errors but never an abort .Is it possible that the problem is with the specific ethernet driver you are using ? Can you specify which one you used ?
I had check the pc location of data abort, it's on dlmalloc. The bug had changed those memory already freed. Cause dlmalloc trigger data abort.
This bug is happens on am335x device. nothing is specific, use am335x_evm_defconfig can reproduce this.
participants (3)
-
qianfan
-
qianfanguijin@163.com
-
Ramon Fried