[PATCH] net: ethernet: Fix phy_set_max_speed by checking for NULL

[PATCH] net: ethernet: Fix phy_set_max_speed by checking for NULL

[Aditya Pakki]

phy_device can be a NULL pointer which is further dereferenced
downstream in phy_set_max_speed. This patch avoids such a scenario.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
---
 drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index aceb9b7b55bd..7eaaecb53aa2 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -213,6 +213,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
 		break;
 
 	case PHY_INTERFACE_MODE_MII:
+		if (!phydev)
+			return -ENODEV;
 		phy_name = "external MII";
 		phy_set_max_speed(phydev, SPEED_100);
 		bcmgenet_sys_writel(priv,
-- 
2.17.1

Re: [PATCH] net: ethernet: Fix phy_set_max_speed by checking for NULL

[Florian Fainelli]

On 3/4/19 3:36 PM, Aditya Pakki wrote:
> phy_device can be a NULL pointer which is further dereferenced
> downstream in phy_set_max_speed. This patch avoids such a scenario.
> 
> Signed-off-by: Aditya Pakki <pakki001@umn.edu>
> ---
>  drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> index aceb9b7b55bd..7eaaecb53aa2 100644
> --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
> +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
> @@ -213,6 +213,8 @@ int bcmgenet_mii_config(struct net_device *dev, bool init)
>  		break;
>  
>  	case PHY_INTERFACE_MODE_MII:
> +		if (!phydev)
> +			return -ENODEV;

This is not where the error checking should go, it would be better to
move this in the caller of bcmgenet_mii_config(), that is
bcmgenet_mii_probe(), but there we already check that dev->phydev is non
NULL. The other code path where bcmgenet_mii_config() can be called is
from bcmgenet_resume(), which means the interface was sucessfully
registered and operation to begin with.

Was that flagged by some static analysis tool or human inspection?
-- 
Florian