[PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Prashant Sengar]

LAN7801 supports fixed-link configurations without an attached PHY.
However, lan78xx_set_wol() unconditionally passes netdev->phydev
to phy_ethtool_set_wol(), causing a NULL pointer dereference when
a userspace WoL request reaches this path.

Use phylink_expects_phy() to skip PHY WoL configuration for fixed
links, and use phylink_ethtool_set_wol() for configurations that
expect a PHY. This avoids the NULL dereference while keeping PHY
operations within the phylink API.

The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
driver. With this change, the same request completes successfully.

Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>
---
v2:
  - Use phylink_expects_phy() to avoid PHY WoL operations for
    fixed-link configurations.
  - Use phylink_ethtool_set_wol() instead of the direct PHY
    helper, addressing Andrew Lunn's review.
  - Preserve the existing controller WoL configuration order.
v1: https://lore.kernel.org/netdev/20261018151830.643511-1-prashantsengar25031@gmail.com/
 drivers/net/usb/lan78xx.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5655941f1478..1702f633d42e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -1805,7 +1805,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
 	if (ret < 0)
 		goto exit_pm_put;
 
-	ret = phy_ethtool_set_wol(netdev->phydev, wol);
+	if (phylink_expects_phy(dev->phylink))
+		ret = phylink_ethtool_set_wol(dev->phylink, wol);
+
 
 exit_pm_put:
 	usb_autopm_put_interface(dev->intf);
-- 
2.55.0

Re: [PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[sashiko-bot]

> LAN7801 supports fixed-link configurations without an attached PHY.
> However, lan78xx_set_wol() unconditionally passes netdev->phydev
> to phy_ethtool_set_wol(), causing a NULL pointer dereference when
> a userspace WoL request reaches this path.
> 
> Use phylink_expects_phy() to skip PHY WoL configuration for fixed
> links, and use phylink_ethtool_set_wol() for configurations that
> expect a PHY. This avoids the NULL dereference while keeping PHY
> operations within the phylink API.
> 
> The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
> An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
> driver. With this change, the same request completes successfully.
> 
> Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
> Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261019193148.1381545-1-prashantsengar25031@gmail.com?part=1

Re: [PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Andrew Lunn]

> @@ -1805,7 +1805,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
>  	if (ret < 0)
>  		goto exit_pm_put;
>  
> -	ret = phy_ethtool_set_wol(netdev->phydev, wol);
> +	if (phylink_expects_phy(dev->phylink))

Is phylink_expects_phy() actually needed?

> +		ret = phylink_ethtool_set_wol(dev->phylink, wol);

We try to keep the phylink API simple, and put all the complexity
within phylink. Hence it would be better if you could just call
phylink_ethtool_set_wol() and at the MAC level not have to care about
fixed link. phylink knows if there is a PHY, it should decide what to
do.

	Andrew

Re: [PATCH net v2] net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

[Prashant Sengar]

Hi Andrew,

While testing the unconditional phylink_ethtool_set_wol() call, I
noticed that it returns -EOPNOTSUPP for the PHY-less LAN7801
fixed-link configuration in my QEMU USB Raw Gadget setup.

The NULL dereference is avoided, but lan78xx_set_wol() updates
pdata->wol and the USB wakeup policy before calling phylink. I
observed the following when disabling WoL:

Before SET: WoL = 0x20, USB wakeup enabled
SET WoL=0:  -EOPNOTSUPP
After SET:  WoL = 0x00, USB wakeup disabled

LAN78xx currently doesn't register a mac_wol_set callback with
phylink, although it has its own controller-side WoL handling during
suspend.

I wanted to share this observation while investigating the WoL path.
Is this behavior expected for the fixed-link configuration, or am I
overlooking some existing handling?

Thanks,
Prashant


On Tue, Oct 20, 2026 at 2:54 AM Andrew Lunn <andrew@lunn.ch> wrote:
>
> > @@ -1805,7 +1805,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
> >       if (ret < 0)
> >               goto exit_pm_put;
> >
> > -     ret = phy_ethtool_set_wol(netdev->phydev, wol);
> > +     if (phylink_expects_phy(dev->phylink))
>
> Is phylink_expects_phy() actually needed?
>
> > +             ret = phylink_ethtool_set_wol(dev->phylink, wol);
>
> We try to keep the phylink API simple, and put all the complexity
> within phylink. Hence it would be better if you could just call
> phylink_ethtool_set_wol() and at the MAC level not have to care about
> fixed link. phylink knows if there is a PHY, it should decide what to
> do.
>
>         Andrew