Re: [PATCH 3/5] net: ftgmac100: Enable AST2700 RMII support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: ftgmac100: NULL pointer dereference in ftgmac100_start_hw()
--

commit ca665d10143bb849d0d5767a33bf55e0a57c8c94
Author: Jacky Chou <jacky_chou@aspeedtech.com>
net: ftgmac100: Enable AST2700 RMII support

This commit enables RMII support for the AST2700 MAC by adding a match-data
quirk. It programs the MAC for the selected interface mode by setting the RMII
enable bit when the port uses RMII.

> diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c
> index 67b1fa464a421..b835472da3604 100644
> --- a/drivers/net/ethernet/faraday/ftgmac100.c
> +++ b/drivers/net/ethernet/faraday/ftgmac100.c
[ ... ]
> @@ -355,6 +359,7 @@ static void ftgmac100_init_hw(struct ftgmac100 *priv)
>  static void ftgmac100_start_hw(struct ftgmac100 *priv)
>  {
>  	u32 maccr = ioread32(priv->base + FTGMAC100_OFFSET_MACCR);
> +	struct phy_device *phydev = priv->netdev->phydev;
>  
>  	/* Keep the original GMAC and FAST bits */
>  	maccr &= (FTGMAC100_MACCR_FAST_MODE | FTGMAC100_MACCR_GIGA_MODE);
> @@ -383,6 +388,11 @@ static void ftgmac100_start_hw(struct ftgmac100 *priv)
>  	if (priv->netdev->features & NETIF_F_HW_VLAN_CTAG_RX)
>  		maccr |= FTGMAC100_MACCR_RM_VLAN;
>  
> +	if ((priv->quirks & FTGMAC100_QUIRK_RMII_ENABLE) &&
> +	    phydev->interface == PHY_INTERFACE_MODE_RMII) {

[Severity: High]
Does this code risk a NULL pointer dereference? If the device tree contains
an mdio child node but lacks a phy-handle property, ftgmac100_probe_dt()
returns successfully without configuring a PHY, leaving priv->netdev->phydev
as NULL.

When the network interface is brought up, could evaluating phydev->interface
cause a kernel panic?

[Severity: High]
This is a pre-existing issue, but I noticed the same pattern exists in
ftgmac100_reset_and_config_mac():

ftgmac100_reset_and_config_mac() {
    ...
    if (priv->is_aspeed &&
        priv->netdev->phydev->interface == PHY_INTERFACE_MODE_RMII) {
        ...
    }
    ...
}

Could this also result in a panic under the same malformed device tree
conditions?

> +		maccr |= FTGMAC100_MACCR_RMII_ENABLE;
> +	}
> +
>  	/* Hit the HW */
>  	iowrite32(maccr, priv->base + FTGMAC100_OFFSET_MACCR);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260927-support_ast2700-v1-0-9f03f29d2c82@aspeedtech.com?part=3