From a4050ce7e46cecbc25eadfa89e4b907b1906a4f9 Mon Sep 17 00:00:00 2001 From: Henry Hu Date: Thu, 3 Sep 2026 19:30:46 +0800 Subject: [PATCH] net: phy: microchip_t1: fix NULL pointer dereference in lan887x_phy_init() The issue was discovered via smatch static analyzer: make CHECK="smatch -p=kernel" C=2 drivers/net/phy/microchip_t1.o CHECK scripts/mod/empty.c DESCEND objtool CHECK drivers/net/phy/microchip_t1.c drivers/net/phy/microchip_t1.c:1295 lan887x_phy_init() warn: 'priv->clock' can also be NULL mchp_rds_ptp_probe() returns NULL when CONFIG_MICROCHIP_PHY_RDS_PTP or CONFIG_PTP_1588_CLOCK is disabled. However, lan887x_phy_init() only checks for an error pointer before using the returned clock to configure the periodic output pin, which can result in a NULL pointer dereference. Handle the NULL return as PTP being unavailable and skip the event pin configuration in that case. Smatch no longer reports the NULL dereference warning after the change. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Reviewed-by: Divya Koppera Signed-off-by: Henry Hu Link: https://patch.msgid.link/20260903113046.163630-1-15815827059@163.com Signed-off-by: Jakub Kicinski --- drivers/net/phy/microchip_t1.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/drivers/net/phy/microchip_t1.c b/drivers/net/phy/microchip_t1.c index 3292b2235c8f..e38d20bf6aa4 100644 --- a/drivers/net/phy/microchip_t1.c +++ b/drivers/net/phy/microchip_t1.c @@ -1285,14 +1285,16 @@ static int lan887x_phy_init(struct phy_device *phydev) if (IS_ERR(priv->clock)) return PTR_ERR(priv->clock); - /* Enable pin mux for EVT */ - phy_modify_mmd(phydev, MDIO_MMD_VEND1, - LAN887X_MX_CHIP_TOP_REG_CONTROL1, - LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN, - LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN); + if (priv->clock) { + /* Enable pin mux for EVT */ + phy_modify_mmd(phydev, MDIO_MMD_VEND1, + LAN887X_MX_CHIP_TOP_REG_CONTROL1, + LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN, + LAN887X_MX_CHIP_TOP_REG_CONTROL1_EVT_EN); - /* Initialize pin numbers specific to PEROUT */ - priv->clock->event_pin = 3; + /* Initialize pin numbers specific to PEROUT */ + priv->clock->event_pin = 3; + } priv->init_done = true; }