[PATCH net v2] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[PATCH net v2] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[huhai]

From: Henry Hu <huhai@kylinos.cn>

The issue was discovered via smatch static analyzer:

  make CHECK="smatch -p=kernel"  C=2  drivers/net/phy/microchip_t1.o
    CHECK   scripts/mod/empty.c
    DESCEND objtool
    CHECK   drivers/net/phy/microchip_t1.c
  drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL

mchp_rds_ptp_probe() returns NULL when CONFIG_MICROCHIP_PHY_RDS_PTP or
CONFIG_PTP_1588_CLOCK is disabled. However, lan887x_phy_init() only checks
for an error pointer before using the returned clock to configure the
periodic output pin, which can result in a NULL pointer dereference.

Handle the NULL return as PTP being unavailable and skip the event pin
configuration in that case. Smatch no longer reports the NULL dereference
warning after the change.

Fixes: 8541fc12edcd ("net: phy: microchip_t1: Enable pin out specific to lan887x phy for PEROUT signal")
Cc: stable@vger.kernel.org
Reviewed-by: Divya Koppera <Divya.Koppera@microchip.com>
Signed-off-by: Henry Hu <huhai@kylinos.cn>
---
Changes:
v2:
  - update commit message to include smatch warning
  - add Reviewed-by: Divya Koppera <Divya.Koppera@microchip.com>
  - add Cc: stable@vger.kernel.org

v1: https://lore.kernel.org/all/20260902083342.221050-1-15815827059@163.com/

 drivers/net/phy/microchip_t1.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c
index 3292b2235c8f..e38d20bf6aa4 100644
--- a/drivers/net/phy/microchip_t1.c
+++ b/drivers/net/phy/microchip_t1.c
@@ -1285,14 +1285,16 @@ static int lan887x_phy_init(struct phy_device *phydev)
 		if (IS_ERR(priv->clock))
 			return PTR_ERR(priv->clock);
 
-		/* Enable pin mux for EVT */
-		phy_modify_mmd(phydev, MDIO_MMD_VEND1,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
-			       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
-
-		/* Initialize pin numbers specific to PEROUT */
-		priv->clock->event_pin = 3;
+		if (priv->clock) {
+			/* Enable pin mux for EVT */
+			phy_modify_mmd(phydev, MDIO_MMD_VEND1,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN,
+				       LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN);
+
+			/* Initialize pin numbers specific to PEROUT */
+			priv->clock->event_pin = 3;
+		}
 
 		priv->init_done = true;
 	}
-- 
2.40.1

Re: [PATCH net v2] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[Xuanqiang Luo]

在 2026/9/3 19:30, huhai 写道:
> From: Henry Hu <huhai@kylinos.cn>
>
> The issue was discovered via smatch static analyzer:
>
>    make CHECK="smatch -p=kernel"  C=2  drivers/net/phy/microchip_t1.o
>      CHECK   scripts/mod/empty.c
>      DESCEND objtool
>      CHECK   drivers/net/phy/microchip_t1.c
>    drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL
>
> mchp_rds_ptp_probe() returns NULL when CONFIG_MICROCHIP_PHY_RDS_PTP or
> CONFIG_PTP_1588_CLOCK is disabled. However, lan887x_phy_init() only checks
> for an error pointer before using the returned clock to configure the
> periodic output pin, which can result in a NULL pointer dereference.
>
> Handle the NULL return as PTP being unavailable and skip the event pin
> configuration in that case. Smatch no longer reports the NULL dereference
> warning after the change.
>
> Fixes: 8541fc12edcd ("net: phy: microchip_t1: Enable pin out specific to lan887x phy for PEROUT signal")
> Cc: stable@vger.kernel.org
> Reviewed-by: Divya Koppera <Divya.Koppera@microchip.com>
> Signed-off-by: Henry Hu <huhai@kylinos.cn>

Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Thanks,
Xuanqiang

Re: [PATCH net v2] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Thu,  3 Sep 2026 19:30:46 +0800 you wrote:
> From: Henry Hu <huhai@kylinos.cn>
> 
> The issue was discovered via smatch static analyzer:
> 
>   make CHECK="smatch -p=kernel"  C=2  drivers/net/phy/microchip_t1.o
>     CHECK   scripts/mod/empty.c
>     DESCEND objtool
>     CHECK   drivers/net/phy/microchip_t1.c
>   drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL
> 
> [...]

Here is the summary with links:
  - [net,v2] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init()
    https://git.kernel.org/netdev/net-next/c/a4050ce7e46c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html