Skip to content

Commit 7c1e7e9

Browse files
Paul Gortmakerdavem330
authored andcommitted
gianfar: dont conditionally alloc Rx/Err irq structs
Commit ee873fd "gianfar: Pack struct gfar_priv_grp into three cachelines" causes the following null dereference at driver init on sbc8548: libphy: Freescale PowerQUICC MII Bus: probed Unable to handle kernel paging request for data at address 0x00000000 Faulting instruction address: 0xc01d6a38 Oops: Kernel access of bad area, sig: 11 [#1] [...] NIP [c01d6a38] gfar_parse_group+0x228/0x280 LR [c01d6a34] gfar_parse_group+0x224/0x280 Call Trace: [ef82dd60] [c01d6a34] gfar_parse_group+0x224/0x280 (unreliable) [ef82dd90] [c01d73a4] gfar_probe+0x284/0xfe0 The reason is that the commit also changed the allocation of the Rx and error handling irq structs to be skipped for !MQ_MG_MODE. In the !MQ_MG_MODE case, only the Tx irq struct is allocated. Digging further, we see that MQ_MG_MODE is set only if we find the OF compatible string "fsl,etsec2". A quick grep in the dts directory shows lots of boards that support Rx/Tx/Err, but without this specific compat string. And hence they go after the unallocated Rx/Error structs and cause the above oops. Hence such a change can not be deployed until all the dts files are updated and sufficiently deployed. Further, the optimization is of limited value, since the kmalloc'd struct in question has only a single unsigned int, and an (IFNAMSIZ + 6) sized string. Note that no changes to the freeing code are needed here, as it already did an unconditional free of Rx/Tx/Error gfar_irqinfo. Cc: Claudiu Manoil <claudiu.manoil@freescale.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 2700092 commit 7c1e7e9

File tree

1 file changed

+4
-12
lines changed

1 file changed

+4
-12
lines changed

drivers/net/ethernet/freescale/gianfar.c

Lines changed: 4 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -580,19 +580,11 @@ static int gfar_parse_group(struct device_node *np,
580580
u32 *queue_mask;
581581
int i;
582582

583-
if (priv->mode == MQ_MG_MODE) {
584-
for (i = 0; i < GFAR_NUM_IRQS; i++) {
585-
grp->irqinfo[i] = kzalloc(sizeof(struct gfar_irqinfo),
586-
GFP_KERNEL);
587-
if (!grp->irqinfo[i])
588-
return -ENOMEM;
589-
}
590-
} else {
591-
grp->irqinfo[GFAR_TX] = kzalloc(sizeof(struct gfar_irqinfo),
592-
GFP_KERNEL);
593-
if (!grp->irqinfo[GFAR_TX])
583+
for (i = 0; i < GFAR_NUM_IRQS; i++) {
584+
grp->irqinfo[i] = kzalloc(sizeof(struct gfar_irqinfo),
585+
GFP_KERNEL);
586+
if (!grp->irqinfo[i])
594587
return -ENOMEM;
595-
grp->irqinfo[GFAR_RX] = grp->irqinfo[GFAR_ER] = NULL;
596588
}
597589

598590
grp->regs = of_iomap(np, 0);

0 commit comments

Comments
 (0)