linux-kernel - Re: [RESEND] net: phy: fix NULL pointer dereference in phy_polling

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aJNSDeyJn5aZG7xs@shell.armlinux.org.uk>
Date: Wed, 6 Aug 2025 14:01:01 +0100
From: "Russell King (Oracle)" <linux@...linux.org.uk>
To: Xu Yang <xu.yang_2@....com>
Cc: andrew@...n.ch, hkallweit1@...il.com, o.rempel@...gutronix.de,
	pabeni@...hat.com, netdev@...r.kernel.org, imx@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [RESEND] net: phy: fix NULL pointer dereference in
 phy_polling_mode()

On Wed, Aug 06, 2025 at 04:56:58PM +0800, Xu Yang wrote:
> Hi Russell,
> 
> On Wed, Aug 06, 2025 at 09:45:01AM +0100, Russell King (Oracle) wrote:
> > On Wed, Aug 06, 2025 at 04:29:31PM +0800, Xu Yang wrote:
> > > Not all phy devices have phy driver attached, so fix the NULL pointer
> > > dereference issue in phy_polling_mode() which was observed on USB net
> > > devices.
> > 
> > See my comments in response to your first posting.
> 
> Thanks for the comments!
> 
> Reproduce step is simple:
> 
> 1. connect an USB to Ethernet device to USB port, I'm using "D-Link Corp.
>    DUB-E100 Fast Ethernet Adapter".
> 2. the asix driver (drivers/net/usb/asix_devices.c) will bind to this USB
>    device.
> 
> root@...95evk:~# lsusb -t
> /:  Bus 001.Port 001: Dev 001, Class=root_hub, Driver=ci_hdrc/1p, 480M
>     |__ Port 001: Dev 003, If 0, Class=Vendor Specific Class, Driver=asix, 480M
> 
> 3. then the driver will create many mdio devices. 
> 
> root@...95evk:/sys/bus/mdio_bus# ls -d devices/usb*
> devices/usb-001:005:00  devices/usb-001:005:04  devices/usb-001:005:08  devices/usb-001:005:0c  devices/usb-001:005:10  devices/usb-001:005:14  devices/usb-001:005:18  devices/usb-001:005:1c
> devices/usb-001:005:01  devices/usb-001:005:05  devices/usb-001:005:09  devices/usb-001:005:0d  devices/usb-001:005:11  devices/usb-001:005:15  devices/usb-001:005:19  devices/usb-001:005:1d
> devices/usb-001:005:02  devices/usb-001:005:06  devices/usb-001:005:0a  devices/usb-001:005:0e  devices/usb-001:005:12  devices/usb-001:005:16  devices/usb-001:005:1a  devices/usb-001:005:1e
> devices/usb-001:005:03  devices/usb-001:005:07  devices/usb-001:005:0b  devices/usb-001:005:0f  devices/usb-001:005:13  devices/usb-001:005:17  devices/usb-001:005:1b  devices/usb-001:005:1f

This looks broken - please check what
/sys/bus/mdio_bus/devices/usb*/phy_id contains.

However, this patch should stop the oops. Please test and let me know
whether it works. Thanks.

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 7556aa3dd7ee..e6a673faabe6 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -288,7 +288,7 @@ static bool phy_uses_state_machine(struct phy_device *phydev)
 		return phydev->attached_dev && phydev->adjust_link;
 
 	/* phydev->phy_link_change is implicitly phylink_phy_change() */
-	return true;
+	return !!phydev->phy_link_change;
 }
 
 static bool mdio_bus_phy_may_suspend(struct phy_device *phydev)
-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!