Re: [PATCH net-next v2 3/6] net: ftgmac100: Enable AST2700 RMII support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: ftgmac100: NULL pointer dereference in ftgmac100_start_hw() on missing PHY
--

commit 9ce856b5087337010253eb3a985d1756ba877130
Author: Jacky Chou <jacky_chou@aspeedtech.com>

net: ftgmac100: Enable AST2700 RMII support

This commit adds a match-data quirk to set the RMII enable bit when an AST2700
port uses RMII. This ensures the MAC is programmed correctly for the selected
interface mode.

> diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
> index 67b1fa464a421..b835472da3604 100644
> --- a/drivers/net/ethernet/faraday/ftgmac100.c
> +++ b/drivers/net/ethernet/faraday/ftgmac100.c
[ ... ]
> @@ -355,6 +359,7 @@ static void ftgmac100_init_hw(struct ftgmac100 *priv)
>  static void ftgmac100_start_hw(struct ftgmac100 *priv)
>  {
>  	u32 maccr = ioread32(priv->base + FTGMAC100_OFFSET_MACCR);
> +	struct phy_device *phydev = priv->netdev->phydev;
>  
>  	/* Keep the original GMAC and FAST bits */
>  	maccr &= (FTGMAC100_MACCR_FAST_MODE | FTGMAC100_MACCR_GIGA_MODE);
> @@ -383,6 +388,11 @@ static void ftgmac100_start_hw(struct ftgmac100 *priv)
>  	if (priv->netdev->features & NETIF_F_HW_VLAN_CTAG_RX)
>  		maccr |= FTGMAC100_MACCR_RM_VLAN;
>  
> +	if ((priv->quirks & FTGMAC100_QUIRK_RMII_ENABLE) &&
> +	    phydev->interface == PHY_INTERFACE_MODE_RMII) {

[Severity: High]
Could phydev be NULL here?

If the driver probes an AST2700 device tree that lacks a phy-handle (or
fixed-link / use-ncsi) but contains an mdio child node, ftgmac100_probe_dt()
will exit successfully while leaving priv->netdev->phydev as NULL.

When the interface is subsequently brought up (e.g., via ip link set up),
ftgmac100_open() calls ftgmac100_start_hw() prior to verifying if a PHY exists.
Since the AST2700 quirk is enabled, could evaluating phydev->interface cause a
NULL pointer dereference and kernel panic?

> +		maccr |= FTGMAC100_MACCR_RMII_ENABLE;
> +	}
> +
>  	/* Hit the HW */
>  	iowrite32(maccr, priv->base + FTGMAC100_OFFSET_MACCR);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006-support_ast2700-v2-0-36de51fb8066@aspeedtech.com?part=3