Commit 1b8ef142 authored by Marek Behún's avatar Marek Behún Committed by David S. Miller

net: phy: marvell10g: fix null pointer dereference

Commit c3e302ed ("net: phy: marvell10g: fix temperature sensor on 2110")
added a check for PHY ID via phydev->drv->phy_id in a function which is
called by devres at a time when phydev->drv is already set to null by
phy_remove function.

This null pointer dereference can be triggered via SFP subsystem with a
SFP module containing this Marvell PHY. When the SFP interface is put
down, the SFP subsystem removes the PHY.

Fixes: c3e302ed ("net: phy: marvell10g: fix temperature sensor on 2110")
Signed-off-by: default avatarMarek Behún <marek.behun@nic.cz>
Cc: Maxime Chevallier <maxime.chevallier@bootlin.com>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Baruch Siach <baruch@tkos.co.il>
Cc: Russell King <rmk+kernel@armlinux.org.uk>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0f5907af
...@@ -208,13 +208,6 @@ static int mv3310_hwmon_config(struct phy_device *phydev, bool enable) ...@@ -208,13 +208,6 @@ static int mv3310_hwmon_config(struct phy_device *phydev, bool enable)
MV_V2_TEMP_CTRL_MASK, val); MV_V2_TEMP_CTRL_MASK, val);
} }
static void mv3310_hwmon_disable(void *data)
{
struct phy_device *phydev = data;
mv3310_hwmon_config(phydev, false);
}
static int mv3310_hwmon_probe(struct phy_device *phydev) static int mv3310_hwmon_probe(struct phy_device *phydev)
{ {
struct device *dev = &phydev->mdio.dev; struct device *dev = &phydev->mdio.dev;
...@@ -238,10 +231,6 @@ static int mv3310_hwmon_probe(struct phy_device *phydev) ...@@ -238,10 +231,6 @@ static int mv3310_hwmon_probe(struct phy_device *phydev)
if (ret) if (ret)
return ret; return ret;
ret = devm_add_action_or_reset(dev, mv3310_hwmon_disable, phydev);
if (ret)
return ret;
priv->hwmon_dev = devm_hwmon_device_register_with_info(dev, priv->hwmon_dev = devm_hwmon_device_register_with_info(dev,
priv->hwmon_name, phydev, priv->hwmon_name, phydev,
&mv3310_hwmon_chip_info, NULL); &mv3310_hwmon_chip_info, NULL);
...@@ -426,6 +415,11 @@ static int mv3310_probe(struct phy_device *phydev) ...@@ -426,6 +415,11 @@ static int mv3310_probe(struct phy_device *phydev)
return phy_sfp_probe(phydev, &mv3310_sfp_ops); return phy_sfp_probe(phydev, &mv3310_sfp_ops);
} }
static void mv3310_remove(struct phy_device *phydev)
{
mv3310_hwmon_config(phydev, false);
}
static int mv3310_suspend(struct phy_device *phydev) static int mv3310_suspend(struct phy_device *phydev)
{ {
return mv3310_power_down(phydev); return mv3310_power_down(phydev);
...@@ -784,6 +778,7 @@ static struct phy_driver mv3310_drivers[] = { ...@@ -784,6 +778,7 @@ static struct phy_driver mv3310_drivers[] = {
.read_status = mv3310_read_status, .read_status = mv3310_read_status,
.get_tunable = mv3310_get_tunable, .get_tunable = mv3310_get_tunable,
.set_tunable = mv3310_set_tunable, .set_tunable = mv3310_set_tunable,
.remove = mv3310_remove,
}, },
{ {
.phy_id = MARVELL_PHY_ID_88E2110, .phy_id = MARVELL_PHY_ID_88E2110,
...@@ -798,6 +793,7 @@ static struct phy_driver mv3310_drivers[] = { ...@@ -798,6 +793,7 @@ static struct phy_driver mv3310_drivers[] = {
.read_status = mv3310_read_status, .read_status = mv3310_read_status,
.get_tunable = mv3310_get_tunable, .get_tunable = mv3310_get_tunable,
.set_tunable = mv3310_set_tunable, .set_tunable = mv3310_set_tunable,
.remove = mv3310_remove,
}, },
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment