From 96c201a2f43ea49a65f32929494ac68f2b08b9a3 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 22 Sep 2026 16:24:33 -0700 Subject: [PATCH 1/3] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring() If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(), error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring(). Without checking if priv->rx_cbs is non-NULL, bcm_sysport_fini_rx_ring() dereferences priv->rx_cbs, resulting in a NULL pointer dereference. Add a check for !priv->rx_cbs at the beginning of bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring(). Cc: stable+noautosel@kernel.org # unlikely driver error path Reviewed-by: Nicolai Buchwitz Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260922232440.598918-4-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c index 8a566b98f486..4d8c7d2f24a4 100644 --- a/drivers/net/ethernet/broadcom/bcmsysport.c +++ b/drivers/net/ethernet/broadcom/bcmsysport.c @@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct bcm_sysport_priv *priv) if (!(reg & RDMA_DISABLED)) netdev_warn(priv->netdev, "RDMA not stopped!\n"); + if (!priv->rx_cbs) + return; + for (i = 0; i < priv->num_rx_bds; i++) { cb = &priv->rx_cbs[i]; if (dma_unmap_addr(cb, dma_addr)) From 1b94a9b462d869bbb466767caa28b197953f2a37 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 22 Sep 2026 16:24:34 -0700 Subject: [PATCH 2/3] net: systemport: Fix Wake-on-LAN RXCHK filter enable loop In bcm_sysport_suspend_to_wol(), the loop enabling programmed RXCHK filters in RXCHK_CONTROL used an auxiliary counter 'i' instead of the actual set filter index 'index'. When non-contiguous filters were configured (for example, if filter 0 was deleted and filter 1 remained), the code would enable bit (RXCHK_BRCM_TAG_MATCH_SHIFT + 0) corresponding to filter 0 rather than filter 1, causing Wake-on-LAN filter matching to fail. Fix this by using the filter 'index' to set the appropriate match bit in RXCHK_CONTROL. Cc: stable+noautosel@kernel.org # never worked Reviewed-by: Nicolai Buchwitz Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260922232440.598918-5-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bcmsysport.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c index 4d8c7d2f24a4..03d381d4e9a8 100644 --- a/drivers/net/ethernet/broadcom/bcmsysport.c +++ b/drivers/net/ethernet/broadcom/bcmsysport.c @@ -2650,7 +2650,7 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) { struct net_device *ndev = priv->netdev; unsigned int timeout = 1000; - unsigned int index, i = 0; + unsigned int index; u32 reg; reg = umac_readl(priv, UMAC_MPD_CTRL); @@ -2680,10 +2680,8 @@ static int bcm_sysport_suspend_to_wol(struct bcm_sysport_priv *priv) reg = rxchk_readl(priv, RXCHK_CONTROL); reg &= ~(RXCHK_BRCM_TAG_MATCH_MASK << RXCHK_BRCM_TAG_MATCH_SHIFT); - for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX) { - reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + i); - i++; - } + for_each_set_bit(index, priv->filters, RXCHK_BRCM_TAG_MAX) + reg |= BIT(RXCHK_BRCM_TAG_MATCH_SHIFT + index); reg |= RXCHK_EN | RXCHK_BRCM_TAG_EN; rxchk_writel(priv, reg, RXCHK_CONTROL); } From 1c6214e6daf604b16f9bf1fd9d48124ef702313c Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 22 Sep 2026 16:24:38 -0700 Subject: [PATCH 3/3] net: systemport: Fix inverted error messages in bcm_sysport_stop() In bcm_sysport_stop(), the error messages printed when tdma_enable_set() and rdma_enable_set() time out were inverted: the failure of tdma_enable_set() logged 'timeout disabling RDMA' and the failure of rdma_enable_set() logged 'timeout disabling TDMA'. Swap the error messages so they correctly describe the failing engine. Reviewed-by: Nicolai Buchwitz Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260922232440.598918-9-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c index 03d381d4e9a8..8313da5f8a63 100644 --- a/drivers/net/ethernet/broadcom/bcmsysport.c +++ b/drivers/net/ethernet/broadcom/bcmsysport.c @@ -2086,7 +2086,7 @@ static int bcm_sysport_stop(struct net_device *dev) ret = tdma_enable_set(priv, 0); if (ret) { - netdev_err(dev, "timeout disabling RDMA\n"); + netdev_err(dev, "timeout disabling TDMA\n"); return ret; } @@ -2095,7 +2095,7 @@ static int bcm_sysport_stop(struct net_device *dev) ret = rdma_enable_set(priv, 0); if (ret) { - netdev_err(dev, "timeout disabling TDMA\n"); + netdev_err(dev, "timeout disabling RDMA\n"); return ret; }