linux-kernel - [PATCH net v1] lan78xx: Fix crash with multiple device attach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240502045748.37627-1-rengarajan.s@microchip.com>
Date: Thu, 2 May 2024 10:27:48 +0530
From: Rengarajan S <rengarajan.s@...rochip.com>
To: <woojung.huh@...rochip.com>, <UNGLinuxDriver@...rochip.com>,
	<davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <netdev@...r.kernel.org>, <linux-usb@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
CC: <rengarajan.s@...rochip.com>
Subject: [PATCH net v1] lan78xx: Fix crash with multiple device attach

After the first device(MAC + PHY) is attached, the corresponding
fixup gets registered and before it is unregistered next device
is attached causing the dev pointer of second device to be NULL.
Fixed the issue with multiple PHY attach by unregistering PHY
at the end of probe. Removed the unregistration during phy_init
since the handling has been taken care in probe.

Fixes: 89b36fb5e532 ("lan78xx: Lan7801 Support for Fixed PHY")
Signed-off-by: Rengarajan S <rengarajan.s@...rochip.com>
---

 drivers/net/usb/lan78xx.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5add4145d..3ec79620f 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2383,14 +2383,8 @@ static int lan78xx_phy_init(struct lan78xx_net *dev)
 		netdev_err(dev->net, "can't attach PHY to %s\n",
 			   dev->mdiobus->id);
 		if (dev->chipid == ID_REV_CHIP_ID_7801_) {
-			if (phy_is_pseudo_fixed_link(phydev)) {
+			if (phy_is_pseudo_fixed_link(phydev))
 				fixed_phy_unregister(phydev);
-			} else {
-				phy_unregister_fixup_for_uid(PHY_KSZ9031RNX,
-							     0xfffffff0);
-				phy_unregister_fixup_for_uid(PHY_LAN8835,
-							     0xfffffff0);
-			}
 		}
 		return -EIO;
 	}
@@ -4458,6 +4452,14 @@ static int lan78xx_probe(struct usb_interface *intf,
 	pm_runtime_set_autosuspend_delay(&udev->dev,
 					 DEFAULT_AUTOSUSPEND_DELAY);
 
+	/* Unregistering Fixup to avoid crash with multiple device
+	 * attach.
+	 */
+	phy_unregister_fixup_for_uid(PHY_KSZ9031RNX,
+				     0xfffffff0);
+	phy_unregister_fixup_for_uid(PHY_LAN8835,
+				     0xfffffff0);
+
 	return 0;
 
 out8:
-- 
2.25.1