[PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[huhai]

From: huhai <huhai@kylinos.cn>

mchp_rds_ptp_probe() may return NULL when CONFIG_PTP_1588_CLOCK is disabled.
lan887x_phy_init() only checks for an error pointer before using the returned
clock to configure the periodic output pin, which can result in a NULL
pointer dereference.

Handle the NULL return as PTP being unavailable and skip the event pin
configuration in that case.

Fixes: 8541fc12edcd ("net: phy: microchip_t1: Enable pin out specific to lan887x phy for PEROUT signal")
Signed-off-by: huhai <huhai@kylinos.cn>
---
 drivers/net/phy/microchip_t1.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c
index 3292b2235c8f..e38d20bf6aa4 100644
--- a/drivers/net/phy/microchip_t1.c
+++ b/drivers/net/phy/microchip_t1.c
@@ -1285,14 +1285,16 @@ static int lan887x_phy_init(struct phy_device *phydev)
 		if (IS_ERR(priv->clock))
 			return PTR_ERR(priv->clock);
 
-		/* Enable pin mux for EVT */
-		phy_modify_mmd(phydev, MDIO_MMD_VEND1,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
-
-		/* Initialize pin numbers specific to PEROUT */
-		priv->clock->event_pin = 3;
+		if (priv->clock) {
+			/* Enable pin mux for EVT */
+			phy_modify_mmd(phydev, MDIO_MMD_VEND1,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
+
+			/* Initialize pin numbers specific to PEROUT */
+			priv->clock->event_pin = 3;
+		}
 
 		priv->init_done = true;
 	}
-- 
2.40.1

RE: [PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[Divya.Koppera]

 > mchp_rds_ptp_probe() may return NULL when CONFIG_PTP_1588_CLOCK is
> disabled.
> lan887x_phy_init() only checks for an error pointer before using the returned
> clock to configure the periodic output pin, which can result in a NULL pointer
> dereference.
> 
> Handle the NULL return as PTP being unavailable and skip the event pin
> configuration in that case.
> 
> Fixes: 8541fc12edcd ("net: phy: microchip_t1: Enable pin out specific to
> lan887x phy for PEROUT signal")
> Signed-off-by: huhai <huhai@kylinos.cn>
> ---
>  drivers/net/phy/microchip_t1.c | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c
> index 3292b2235c8f..e38d20bf6aa4 100644
> --- a/drivers/net/phy/microchip_t1.c
> +++ b/drivers/net/phy/microchip_t1.c
> @@ -1285,14 +1285,16 @@ static int lan887x_phy_init(struct phy_device
> *phydev)
>                 if (IS_ERR(priv->clock))
>                         return PTR_ERR(priv->clock);
> 
> -               /* Enable pin mux for EVT */
> -               phy_modify_mmd(phydev, MDIO_MMD_VEND1,
> -                              LAN887X_MX_CHIP_TOP_REG_CONTROL1,
> -                              LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
> -                              LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
> -
> -               /* Initialize pin numbers specific to PEROUT */
> -               priv->clock->event_pin = 3;
> +               if (priv->clock) {
> +                       /* Enable pin mux for EVT */
> +                       phy_modify_mmd(phydev, MDIO_MMD_VEND1,
> +                                      LAN887X_MX_CHIP_TOP_REG_CONTROL1,
> +                                      LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
> +
> + LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
> +
> +                       /* Initialize pin numbers specific to PEROUT */
> +                       priv->clock->event_pin = 3;
> +               }

Reviewed-by: Divya Koppera <Divya.Koppera@microchip.com>

> 
>                 priv->init_done = true;
>         }
> --
> 2.40.1

Re: [PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[Xuanqiang Luo]

在 2026/9/2 16:33, huhai 写道:
> From: huhai <huhai@kylinos.cn>
>
> mchp_rds_ptp_probe() may return NULL when CONFIG_PTP_1588_CLOCK is disabled.

When CONFIG_MICROCHIP_PHY_RDS_PTP=n, the stub for
mchp_rds_ptp_probe() also returns NULL, even if
CONFIG_PTP_1588_CLOCK=y. Please mention this case in the commit message.

> lan887x_phy_init() only checks for an error pointer before using the returned
> clock to configure the periodic output pin, which can result in a NULL
> pointer dereference.
>
> Handle the NULL return as PTP being unavailable and skip the event pin
> configuration in that case.
>
> Fixes: 8541fc12edcd ("net: phy: microchip_t1: Enable pin out specific to lan887x phy for PEROUT signal")
> Signed-off-by: huhai <huhai@kylinos.cn>

Since this is a crash fix suitable for the net tree, please mark
the patch as [PATCH net] and add:

Cc: stable@vger.kernel.org

Thanks,
Xuanqiang

Re: [PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[Jakub Kicinski]

On Wed, 2 Sep 2026 17:16:48 +0800 Xuanqiang Luo wrote:
> > mchp_rds_ptp_probe() may return NULL when CONFIG_PTP_1588_CLOCK is disabled.  
> 
> When CONFIG_MICROCHIP_PHY_RDS_PTP=n, the stub for
> mchp_rds_ptp_probe() also returns NULL, even if
> CONFIG_PTP_1588_CLOCK=y. Please mention this case in the commit message.

Speaking of improvements to the commits message - please also explain
how the issue was found, reproduced, and fix validated.

It'd be good to improve the spalling of your name (rather just
repeating your email login) a little; or just add your real name in
unicode characters in () brackets, like huhai ($unicode chars) <email>.

Re:Re: [PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[huhai]

At 2026-09-03 06:58:25, "Jakub Kicinski" <kuba@kernel.org> wrote:
>On Wed, 2 Sep 2026 17:16:48 +0800 Xuanqiang Luo wrote:
>> > mchp_rds_ptp_probe() may return NULL when CONFIG_PTP_1588_CLOCK is disabled.  
>> 
>> When CONFIG_MICROCHIP_PHY_RDS_PTP=n, the stub for
>> mchp_rds_ptp_probe() also returns NULL, even if
>> CONFIG_PTP_1588_CLOCK=y. Please mention this case in the commit message.
>
>Speaking of improvements to the commits message - please also explain
>how the issue was found, reproduced, and fix validated.
>

The issue was discovered via smatch:

make CHECK="smatch -p=kernel"  C=2  drivers/net/phy/microchip_t1.o
  CHECK   scripts/mod/empty.c
  DESCEND objtool
  CHECK   drivers/net/phy/microchip_t1.c
drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL

I will add the above information to the commit message in the next version of the patch.

Then, disassembly confirmed that a null pointer dereference does indeed exist:

objdump -drSwC --no-show-raw-insn --disassemble=lan887x_phy_init drivers/net/phy/microchip_t1.o
             	priv->clock = mchp_rds_ptp_probe(phydev, MDIO_MMD_VEND1,
    10c2:       movq   $0x0,0x30(%r13)   # priv->clock = NULL
                ... ...
                priv->clock->event_pin = 3;
    10e7:       mov    0x30(%r13),%rax   # rax = priv->clock = NULL
    10eb:       movl   $0x3,0x190(%rax)  # *(u32 *)(NULL + 0x190) = 3

Additionally, I do not have hardware available to verify and reproduce the issue,
it was identified purely through analysis. After applying a patch, smatch no longer 
produces the warning.

>It'd be good to improve the spalling of your name (rather just
>repeating your email login) a little; or just add your real name in
>unicode characters in () brackets, like huhai ($unicode chars) <email>.

Regarding the name spelling suggestion, I will update my signed-off-by
line to use my full English name in the next version of the patch.

Thanks.