diff mbox series

[v2,2/2] net: eth-uclass: Fix data abort when tftp get nonexistent file via usb

Message ID 20220402025836.19374-2-qianfanguijin@163.com
State Rejected
Delegated to: Ramon Fried
Headers show
Series [v2,1/2] net: eth-uclass: Fix eth_halt | expand

Commit Message

qianfan April 2, 2022, 2:58 a.m. UTC
From: qianfan Zhao <qianfanguijin@163.com>

tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth
device if it is an usb network. usbeth's private data will be unaccessable
when usb_eth_free_pkt, touch it will trigger data abort.

Next is the console messages:

=> tftp xxx
...
Loading: *
TFTP error: 'open failed: No such file or directory' (1)
Not retrying...
data abort
pc : [<9feb6ba2>]          lr : [<9feb6b9f>]

Fix it.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
---
 net/eth-uclass.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Ramon Fried April 14, 2022, 4:39 a.m. UTC | #1
On Sat, Apr 2, 2022 at 5:58 AM <qianfanguijin@163.com> wrote:
>
> From: qianfan Zhao <qianfanguijin@163.com>
>
> tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth
> device if it is an usb network. usbeth's private data will be unaccessable
> when usb_eth_free_pkt, touch it will trigger data abort.
>
> Next is the console messages:
>
> => tftp xxx
> ...
> Loading: *
> TFTP error: 'open failed: No such file or directory' (1)
> Not retrying...
> data abort
> pc : [<9feb6ba2>]          lr : [<9feb6b9f>]
>
> Fix it.
>
> Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
> ---
>  net/eth-uclass.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/net/eth-uclass.c b/net/eth-uclass.c
> index 2b88b6c145..c9bba4f8de 100644
> --- a/net/eth-uclass.c
> +++ b/net/eth-uclass.c
> @@ -407,6 +407,13 @@ int eth_rx(void)
>                 flags = 0;
>                 if (ret > 0)
>                         net_process_received_packet(packet, ret);
> +
> +               /* ethernet maybe halted when packet_handler, check again */
> +               if (!eth_is_active(current)) {
> +                       ret = 0;
> +                       break;
> +               }
> +
>                 if (ret >= 0 && eth_get_ops(current)->free_pkt)
>                         eth_get_ops(current)->free_pkt(current, packet, ret);
>                 if (ret <= 0)
> --
> 2.17.1
>
I wonder how I never experienced this behavior. I have used USB based
ethernet dongles.
And I used tftp and got errors but never an abort .Is it possible that
the problem is with the specific ethernet driver you are using ?
Can you specify which one you used ?
qianfan April 14, 2022, 6:17 a.m. UTC | #2
在 2022/4/14 12:39, Ramon Fried 写道:
> On Sat, Apr 2, 2022 at 5:58 AM <qianfanguijin@163.com> wrote:
>> From: qianfan Zhao <qianfanguijin@163.com>
>>
>> tftp_handler do eth_halt when TFTP_ERROR, but eth_halt will remove eth
>> device if it is an usb network. usbeth's private data will be unaccessable
>> when usb_eth_free_pkt, touch it will trigger data abort.
>>
>> Next is the console messages:
>>
>> => tftp xxx
>> ...
>> Loading: *
>> TFTP error: 'open failed: No such file or directory' (1)
>> Not retrying...
>> data abort
>> pc : [<9feb6ba2>]          lr : [<9feb6b9f>]
>>
>> Fix it.
>>
>> Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
>> ---
>>   net/eth-uclass.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/net/eth-uclass.c b/net/eth-uclass.c
>> index 2b88b6c145..c9bba4f8de 100644
>> --- a/net/eth-uclass.c
>> +++ b/net/eth-uclass.c
>> @@ -407,6 +407,13 @@ int eth_rx(void)
>>                  flags = 0;
>>                  if (ret > 0)
>>                          net_process_received_packet(packet, ret);
>> +
>> +               /* ethernet maybe halted when packet_handler, check again */
>> +               if (!eth_is_active(current)) {
>> +                       ret = 0;
>> +                       break;
>> +               }
>> +
>>                  if (ret >= 0 && eth_get_ops(current)->free_pkt)
>>                          eth_get_ops(current)->free_pkt(current, packet, ret);
>>                  if (ret <= 0)
>> --
>> 2.17.1
>>
> I wonder how I never experienced this behavior. I have used USB based
> ethernet dongles.
> And I used tftp and got errors but never an abort .Is it possible that
> the problem is with the specific ethernet driver you are using ?
> Can you specify which one you used ?

I had check the pc location of data abort, it's on dlmalloc. The bug had 
changed those memory already freed. Cause dlmalloc trigger data abort.

This bug is happens on am335x device.  nothing is specific, use 
am335x_evm_defconfig can reproduce this.
diff mbox series

Patch

diff --git a/net/eth-uclass.c b/net/eth-uclass.c
index 2b88b6c145..c9bba4f8de 100644
--- a/net/eth-uclass.c
+++ b/net/eth-uclass.c
@@ -407,6 +407,13 @@  int eth_rx(void)
 		flags = 0;
 		if (ret > 0)
 			net_process_received_packet(packet, ret);
+
+		/* ethernet maybe halted when packet_handler, check again */
+		if (!eth_is_active(current)) {
+			ret = 0;
+			break;
+		}
+
 		if (ret >= 0 && eth_get_ops(current)->free_pkt)
 			eth_get_ops(current)->free_pkt(current, packet, ret);
 		if (ret <= 0)