From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5D45E2D73A0; Thu, 15 Jan 2026 17:04:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496640; cv=none; b=IK1LL1nPJplNGp11Fvfz8JKj/PhFH6G6PXbS5+rCfbKTINX5VJ4T9w5aQC2ua4R5Ss3h4XjA9ptwJq+BEbaxWcSA17ztcv57Sxt7so9tCeIurL87s6gKjKcYw0D3iuUYCQ+9OuJ3UiwHgSkGu44x36NnLmoO14ewyg8MLjjpWII= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768496640; c=relaxed/simple; bh=62p7FhhztHRNK8rDL1VY3JXsvWLo4B7cZEs9yuoOtO0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=kW3wKX/MdUR7UPKrm8/9/5FB6IgnOckhWBhmTRGgublcABvPr4IJwxC+LP6W/nhLVL0ioSJdbj1W7CZ+fwsFZGJ4kCXR8Lzc+Q8Fsiy2SFB4m6YpS7z90/LnN8s+LXaZ5g3myAA+8GAeRDgD+bnurWBdVPqGHuWsvrMCvk2CsZo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sx5jTgaQ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="sx5jTgaQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3621C116D0; Thu, 15 Jan 2026 17:03:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1768496640; bh=62p7FhhztHRNK8rDL1VY3JXsvWLo4B7cZEs9yuoOtO0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sx5jTgaQBSP0XxfKmVFhhh4fmBaLzo5fRaKK0dB01k9nb9eZ7lMSgBi8b9Og5gNxq 0+VPy+1qydVT+coHp1Fv90qmLs+bIECQtkgEWfQ0k+NzwV2g8TmXzBF1vZU0KTB+Y+ Va2oq8IytKeO9Ak9z7WACCrCUW/Hay4UekMid53s= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Jerry Wu , Vladimir Oltean , Jakub Kicinski , Sasha Levin Subject: [PATCH 6.12 066/119] net: mscc: ocelot: Fix crash when adding interface under a lag Date: Thu, 15 Jan 2026 17:48:01 +0100 Message-ID: <20260115164154.336941276@linuxfoundation.org> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260115164151.948839306@linuxfoundation.org> References: <20260115164151.948839306@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jerry Wu [ Upstream commit 34f3ff52cb9fa7dbf04f5c734fcc4cb6ed5d1a95 ] Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag") fixed a similar issue in the lan966x driver caused by a NULL pointer dereference. The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic and is susceptible to the same crash. This issue specifically affects the ocelot_vsc7514.c frontend, which leaves unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as it uses the DSA framework which registers all ports. Fix this by checking if the port pointer is valid before accessing it. Fixes: 528d3f190c98 ("net: mscc: ocelot: drop the use of the "lags" array") Signed-off-by: Jerry Wu Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/tencent_75EF812B305E26B0869C673DD1160866C90A@qq.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- drivers/net/ethernet/mscc/ocelot.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c index 08bee56aea35f..c345d9b17c892 100644 --- a/drivers/net/ethernet/mscc/ocelot.c +++ b/drivers/net/ethernet/mscc/ocelot.c @@ -2307,14 +2307,16 @@ static void ocelot_set_aggr_pgids(struct ocelot *ocelot) /* Now, set PGIDs for each active LAG */ for (lag = 0; lag < ocelot->num_phys_ports; lag++) { - struct net_device *bond = ocelot->ports[lag]->bond; + struct ocelot_port *ocelot_port = ocelot->ports[lag]; int num_active_ports = 0; + struct net_device *bond; unsigned long bond_mask; u8 aggr_idx[16]; - if (!bond || (visited & BIT(lag))) + if (!ocelot_port || !ocelot_port->bond || (visited & BIT(lag))) continue; + bond = ocelot_port->bond; bond_mask = ocelot_get_bond_mask(ocelot, bond); for_each_set_bit(port, &bond_mask, ocelot->num_phys_ports) { -- 2.51.0