[PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Prashant Sengar]

LAN7801 supports fixed-link configurations without an attached PHY.
However, lan78xx_set_wol() unconditionally passes netdev->phydev
to phy_ethtool_set_wol(), causing a NULL pointer dereference when
a userspace WoL request reaches this path.

Report no WoL capabilities when no PHY is attached, and return
-EOPNOTSUPP from lan78xx_set_wol() before modifying the wakeup
configuration. Keep the existing phylib WoL handling for devices
with an attached PHY.

The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
driver. With this change, the PHY-less configuration no longer
advertises unsupported WoL operations, avoiding the crash.

Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>
---
v3:
  - Report no WoL capabilities when no PHY is attached.
  - Return -EOPNOTSUPP from set_wol() before updating wakeup state
    when no PHY is present.
  - Retain the original phylib WoL call for PHY-attached devices,
    following Andrew Lunn's review.
  - Leave fixed-link MAC WoL support for separate net-next work.

v2: https://lore.kernel.org/netdev/20261019193148.1381545-1-prashantsengar25031@gmail.com/
 drivers/net/usb/lan78xx.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5655941f1478..612e1e46de6d 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1763,7 +1763,11 @@ static void lan78xx_get_wol(struct net_device *netdev,
 	int ret;
 	u32 buf;
 	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
-
+	if (!netdev->phydev) {
+		wol->supported = 0;
+		wol->wolopts = 0;
+		return;
+	}
 	if (usb_autopm_get_interface(dev->intf) < 0)
 		return;
 
@@ -1795,6 +1799,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
 	if (wol->wolopts & ~WAKE_ALL)
 		return -EINVAL;
 
+	if (!netdev->phydev)
+		return -EOPNOTSUPP;
+
 	ret = usb_autopm_get_interface(dev->intf);
 	if (ret < 0)
 		return ret;
@@ -1807,6 +1814,7 @@ static int lan78xx_set_wol(struct net_device *netdev,
 
 	ret = phy_ethtool_set_wol(netdev->phydev, wol);
 
+
 exit_pm_put:
 	usb_autopm_put_interface(dev->intf);
 
-- 
2.55.0

Re: [PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Andrew Lunn]

On Tue, Oct 20, 2026 at 11:42:37PM +0530, Prashant Sengar wrote:
> LAN7801 supports fixed-link configurations without an attached PHY.
> However, lan78xx_set_wol() unconditionally passes netdev->phydev
> to phy_ethtool_set_wol(), causing a NULL pointer dereference when
> a userspace WoL request reaches this path.
> 
> Report no WoL capabilities when no PHY is attached, and return
> -EOPNOTSUPP from lan78xx_set_wol() before modifying the wakeup
> configuration. Keep the existing phylib WoL handling for devices
> with an attached PHY.
> 
> The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
> An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
> driver. With this change, the PHY-less configuration no longer
> advertises unsupported WoL operations, avoiding the crash.
> 
> Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
> Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>


> @@ -1807,6 +1814,7 @@ static int lan78xx_set_wol(struct net_device *netdev,
>  
>  	ret = phy_ethtool_set_wol(netdev->phydev, wol);
>  
> +
>  exit_pm_put:
>  	usb_autopm_put_interface(dev->intf);

Please avoid changes like this.

Once fixed, please add: Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

---
pw-bot: cr