[PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Prashant Sengar]

LAN7801 supports fixed-link configurations without an attached PHY.
However, lan78xx_set_wol() unconditionally passes netdev->phydev
to phy_ethtool_set_wol(), causing a NULL pointer dereference when
a userspace WoL request reaches this path.

Report no WoL capabilities when no PHY is attached, and return
-EOPNOTSUPP from lan78xx_set_wol() before modifying the wakeup
configuration. Keep the existing phylib WoL handling for devices
with an attached PHY.

The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
driver. With this change, the PHY-less configuration no longer
advertises unsupported WoL operations, avoiding the crash.

Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>
---
v3:
  - Report no WoL capabilities when no PHY is attached.
  - Return -EOPNOTSUPP from set_wol() before updating wakeup state
    when no PHY is present.
  - Retain the original phylib WoL call for PHY-attached devices,
    following Andrew Lunn's review.
  - Leave fixed-link MAC WoL support for separate net-next work.

v2: https://lore.kernel.org/netdev/20261019193148.1381545-1-prashantsengar25031@gmail.com/
 drivers/net/usb/lan78xx.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5655941f1478..612e1e46de6d 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1763,7 +1763,11 @@ static void lan78xx_get_wol(struct net_device *netdev,
 	int ret;
 	u32 buf;
 	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
-
+	if (!netdev->phydev) {
+		wol->supported = 0;
+		wol->wolopts = 0;
+		return;
+	}
 	if (usb_autopm_get_interface(dev->intf) < 0)
 		return;
 
@@ -1795,6 +1799,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
 	if (wol->wolopts & ~WAKE_ALL)
 		return -EINVAL;
 
+	if (!netdev->phydev)
+		return -EOPNOTSUPP;
+
 	ret = usb_autopm_get_interface(dev->intf);
 	if (ret < 0)
 		return ret;
@@ -1807,6 +1814,7 @@ static int lan78xx_set_wol(struct net_device *netdev,
 
 	ret = phy_ethtool_set_wol(netdev->phydev, wol);
 
+
 exit_pm_put:
 	usb_autopm_put_interface(dev->intf);
 
-- 
2.55.0

Re: [PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Andrew Lunn]

On Tue, Oct 20, 2026 at 11:42:37PM +0530, Prashant Sengar wrote:
> LAN7801 supports fixed-link configurations without an attached PHY.
> However, lan78xx_set_wol() unconditionally passes netdev->phydev
> to phy_ethtool_set_wol(), causing a NULL pointer dereference when
> a userspace WoL request reaches this path.
> 
> Report no WoL capabilities when no PHY is attached, and return
> -EOPNOTSUPP from lan78xx_set_wol() before modifying the wakeup
> configuration. Keep the existing phylib WoL handling for devices
> with an attached PHY.
> 
> The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
> An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
> driver. With this change, the PHY-less configuration no longer
> advertises unsupported WoL operations, avoiding the crash.
> 
> Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
> Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>


> @@ -1807,6 +1814,7 @@ static int lan78xx_set_wol(struct net_device *netdev,
>  
>  	ret = phy_ethtool_set_wol(netdev->phydev, wol);
>  
> +
>  exit_pm_put:
>  	usb_autopm_put_interface(dev->intf);

Please avoid changes like this.

Once fixed, please add: Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

---
pw-bot: cr

Re: [PATCH net v3] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: usb: lan78xx: WoL left enabled in probe when no PHY is attached
--

commit 875dd87fe0cdd58a79d308dc9e623386e8a76113
Author: Prashant Sengar <prashantsengar25031@gmail.com>

net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

This commit avoids a NULL pointer dereference in lan78xx_set_wol() on
PHY-less configurations by reporting no Wake-on-LAN support in
lan78xx_get_wol() and returning -EOPNOTSUPP from lan78xx_set_wol() when
netdev->phydev is NULL.

> diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
> index 5655941f14783..612e1e46de6dd 100644
> --- a/drivers/net/usb/lan78xx.c
> +++ b/drivers/net/usb/lan78xx.c
> @@ -1763,7 +1763,11 @@ static void lan78xx_get_wol(struct net_device *netdev,
>  	int ret;
>  	u32 buf;
>  	struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
> -
> +	if (!netdev->phydev) {
> +		wol->supported = 0;
> +		wol->wolopts = 0;
> +		return;
> +	}
>  	if (usb_autopm_get_interface(dev->intf) < 0)
>  		return;
>  
> @@ -1795,6 +1799,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
>  	if (wol->wolopts & ~WAKE_ALL)
>  		return -EINVAL;
>  
> +	if (!netdev->phydev)
> +		return -EOPNOTSUPP;

[Severity: Medium]
When netdev->phydev is NULL (for example, on LAN7801 in fixed-link mode),
lan78xx_get_wol() now reports that Wake-on-LAN is unsupported and disabled,
and lan78xx_set_wol() rejects attempts to change it.

However, during probe, lan78xx_probe() -> lan78xx_bind() unconditionally
initializes pdata->wol before lan78xx_phy_init() checks whether a PHY is
present:

drivers/net/usb/lan78xx.c:lan78xx_bind() {
	...
	dev->net->flags |= IFF_MULTICAST;

	pdata->wol = WAKE_MAGIC;
	...
}

And lan78xx_probe() then unconditionally enables wakeup on the USB device:

drivers/net/usb/lan78xx.c:lan78xx_probe() {
	...
	ret = lan78xx_phy_init(dev);
	if (ret < 0)
		goto free_urbs;
	...
	ret = device_set_wakeup_enable(&udev->dev, true);
	...
}

When the system suspends while the interface is open, lan78xx_suspend() uses
pdata->wol to configure the MAC for Magic Packet wakeup (enabling WUCSR_MPEN_
and PMT_CTL_WOL_EN_ in lan78xx_set_suspend()):

drivers/net/usb/lan78xx.c:lan78xx_suspend() {
	...
		} else {
			struct lan78xx_priv *pdata;

			pdata = (struct lan78xx_priv *)(dev->data[0]);
			netif_carrier_off(dev->net);
			ret = lan78xx_set_suspend(dev, pdata->wol);
			if (ret < 0)
				goto out;
		}
	...
}

Does this leave Wake-on-LAN active in hardware and driver state on PHY-less
configurations while ethtool reports it as disabled and prevents userspace
from turning it off?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261020181237.2374075-1-prashantsengar25031@gmail.com?part=1