github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: usb: lan78xx: avoid NULL PHY dereference in WoL setup

Browse Source 
LAN7801 supports fixed-link configurations without an attached PHY.
However, lan78xx_set_wol() unconditionally passes netdev->phydev
to phy_ethtool_set_wol(), causing a NULL pointer dereference when
a userspace WoL request reaches this path.

Report no WoL capabilities when no PHY is attached, and return
-EOPNOTSUPP from lan78xx_set_wol() before modifying the wakeup
configuration. Keep the existing phylib WoL handling for devices
with an attached PHY.

The issue was reproduced using USB Raw Gadget and dummy_hcd in QEMU.
An ETHTOOL_SWOL ioctl triggered a kernel Oops with the original
driver. With this change, the PHY-less configuration no longer
advertises unsupported WoL operations, avoiding the crash.

Fixes: e110bc8258 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Signed-off-by: Prashant Sengar <prashantsengar25031@gmail.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20261020201537.2465655-1-prashantsengar25031@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Prashant Sengar 2026-10-21 01:45:37 +05:30 committed by Jakub Kicinski
parent 61a56877b2
commit dacb77e32e
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/net/usb/lan78xx.c
View File

@ -1767,6 +1767,12 @@ static void lan78xx_get_wol(struct net_device *netdev,
u32 buf;
struct lan78xx_priv *pdata = (struct lan78xx_priv *)(dev->data[0]);
if (!netdev->phydev) {
wol->supported = 0;
wol->wolopts = 0;
return;
}
if (usb_autopm_get_interface(dev->intf) < 0)
return;
@ -1798,6 +1804,9 @@ static int lan78xx_set_wol(struct net_device *netdev,
if (wol->wolopts & ~WAKE_ALL)
return -EINVAL;
if (!netdev->phydev)
return -EOPNOTSUPP;
ret = usb_autopm_get_interface(dev->intf);
if (ret < 0)
return ret;