Skip to contentSkip to conversation

net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

PATCH Applied Andre Kalb 3 participants 3 messages Jan 25, 2023 – Jan 28, 2023

Subsystems (3)
Networking Network drivers Ethernet PHY
lore
Share & tools
lore

Andre Kalb

author
#0 lore raw

PATCH 1/1 net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

From: Andre Kalb <[email protected]>

The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that.

Fixes 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection")
Signed-off-by Andre Kalb <[email protected]>
---
 drivers/net/phy/dp83822.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/phy/dp83822.c +4 -2
index 0b511abb5422..f070aa97c77b 100644
@@ -232,7 +232,8 @@ static int dp83822_config_intr(struct phy_device *phydev)
 				DP83822_ENERGY_DET_INT_EN |
 				DP83822_LINK_QUAL_INT_EN);
 
-		if (!dp83822->fx_enabled)
+		/* Private data pointer is NULL on DP83825/26 */
+		if (!dp83822 || !dp83822->fx_enabled)
 			misr_status |= DP83822_ANEG_COMPLETE_INT_EN |
 				       DP83822_DUP_MODE_CHANGE_INT_EN |
 				       DP83822_SPEED_CHANGED_INT_EN;

@@ -252,7 +253,8 @@ static int dp83822_config_intr(struct phy_device *phydev)
 				DP83822_PAGE_RX_INT_EN |
 				DP83822_EEE_ERROR_CHANGE_INT_EN);
 
-		if (!dp83822->fx_enabled)
+		/* Private data pointer is NULL on DP83825/26 */
+		if (!dp83822 || !dp83822->fx_enabled)
 			misr_status |= DP83822_ANEG_ERR_INT_EN |
 				       DP83822_WOL_PKT_INT_EN;
Signature · 1 line
2.35.3
Reviewed-by on v1 1/1
#1 lore raw
Quoted 11 lines · Andre Kalb

From: Andre Kalb <[email protected]>

The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that.

Fixes 5dc39fd5ef35 ("net: phy: DP83822: Add ability to advertise Fiber connection")
Signed-off-by Andre Kalb <[email protected]>
Reviewed-by Simon Horman <[email protected]>
CI Applied
#2 lore raw
In reply to Andre Kalb
This patch was applied to netdev/net.git (master) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (master)
by Jakub Kicinski <[email protected]>:

Quoted 10 lines · On Wed, 25 Jan 2023 19:23:26 +0100 you wrote:

From: Andre Kalb <[email protected]>

The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP83825/26 models. While all uses of the private data structure are hidden in 82822 specific callbacks, configuring the interrupt is shared across all models. This causes a NULL pointer dereference on the smaller PHYs as it accesses the private data unchecked. Verifying the pointer avoids that.

[...]

Here is the summary with links:
- [net] net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

    https://git.kernel.org/netdev/net/c/422ae7d9c722

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html