Re: [PATCH net-next v4 08/13] net: ethernet: oa_tc6: Use the read_mms/write_mms functions for C45

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The MDIO bus read callback incorrectly transforms negative I/O error codes into a successful read of register value `1`, masking SPI communication or device errors.
--

commit 1a0bc4b5b89b86918a4916cb260bddd03f3d58c8
Author: Ciprian Regus <ciprian.regus@analog.com>
net: ethernet: oa_tc6: Use the read_mms/write_mms functions for C45

This commit replaces the formatting of register addresses in C45 reads and
writes with the new oa_tc6_read_register_mms() and 
oa_tc6_write_register_mms() functions. It also renames the ret variable to 
mms for storing the memory map returned by oa_tc6_get_phy_c45_mms().

> diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
> index d32a1a323d488..4fe4e41136c17 100644
> --- a/drivers/net/ethernet/oa_tc6.c
> +++ b/drivers/net/ethernet/oa_tc6.c
> @@ -500,13 +500,14 @@ int oa_tc6_mdiobus_read_c45(struct mii_bus *bus, int addr, int devnum,
>  {
>  	struct oa_tc6 *tc6 = bus->priv;
>  	u32 regval;
> +	int mms;
>  	int ret;
>  
> -	ret = oa_tc6_get_phy_c45_mms(devnum);
> -	if (ret < 0)
> -		return ret;
> +	mms = oa_tc6_get_phy_c45_mms(devnum);
> +	if (mms < 0)
> +		return mms;
>  
> -	ret = oa_tc6_read_register(tc6, (ret << 16) | regnum, &regval);
> +	ret = oa_tc6_read_register_mms(tc6, mms, regnum, &regval);
>  	if (ret)
>  		return ret;

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing the error
handling for MDIO reads here, I noticed an issue in the related standard read
function.

Does oa_tc6_mdiobus_read() incorrectly handle negative error codes?

In drivers/net/ethernet/oa_tc6.c:oa_tc6_mdiobus_read():

    bool ret;

    ret = oa_tc6_read_register(tc6, OA_TC6_PHY_STD_REG_ADDR_BASE |
                   (regnum & OA_TC6_PHY_STD_REG_ADDR_MASK),
                   &regval);
    if (ret)
        return ret;

When oa_tc6_read_register() fails and returns a negative error code (like
-ENODEV or -EIO), the bool cast converts it to 1 (true).

Returning 1 instead of the negative error code causes the PHY framework to
interpret the I/O error as a successful read of the value 1.

Could this lead to silent failures, incorrect PHY ID detection, or
misconfiguration of the MAC-PHY device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609-adin1140-driver-v4-0-0753e28ee004@analog.com?part=8