Re: [PATCH net 1/2] net: usb: smsc95xx: propagate MDIO reset errors

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] net: usb: smsc95xx: smsc95xx_mdiobus_reset() returns 4 on
  success
--

commit 2539b52a07146a1a92198f65c494924038af75bf
Author: Artem Novak <artem122novak@gmail.com>

net: usb: smsc95xx: propagate MDIO reset errors

This commit changes smsc95xx_mdiobus_reset() to return ret instead of 0
so that register access errors during external PHY reset are propagated
to callers.

> diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
> index 130a460c1f546..f85ee5f8a5394 100644
> --- a/drivers/net/usb/smsc95xx.c
> +++ b/drivers/net/usb/smsc95xx.c
> @@ -291,7 +291,7 @@ static int smsc95xx_mdiobus_reset(struct mii_bus *bus)
>  reset_out:
>  	mutex_unlock(&dev->phy_mutex);
>  
> -	return 0;
> +	return ret;
>  }
>  
>  static int smsc95xx_mdiobus_read(struct mii_bus *bus, int phy_id, int idx)

[Severity: High]
Does smsc95xx_mdiobus_reset() now return 4 on success for devices with an
external PHY?

smsc95xx_write_reg() returns the number of bytes written (4) on success,
and ret is not reset to 0 before reaching reset_out.  __mdiobus_register()
treats any non-zero return from bus->reset() as an error and returns 4 to
smsc95xx_bind(), which unwinds and frees pdata (leaving dev->driver_priv
dangling) and returns 4 to usbnet_probe().  Because usbnet_probe() only
aborts when status < 0, probe continues and registers the net_device with
a freed dev->driver_priv and a NULL phydev, leading to a use-after-free
in subsequent driver callbacks.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261114050954.275495-1-artem122novak@gmail.com?part=1