Skip to content

Commit 1c613be

Browse files
vladimirolteankuba-moo
authored andcommitted
net: phy: prevent stale pointer dereference in phy_init()
mdio_bus_init() and phy_driver_register() both have error paths, and if those are ever hit, ethtool will have a stale pointer to the phy_ethtool_phy_ops stub structure, which references memory from a module that failed to load (phylib). It is probably hard to force an error in this code path even manually, but the error teardown path of phy_init() should be the same as phy_exit(), which is now simply not the case. Fixes: 55d8f05 ("net: phy: Register ethtool PHY operations") Link: https://lore.kernel.org/netdev/ZLaiJ4G6TaJYGJyU@shell.armlinux.org.uk/ Suggested-by: Russell King (Oracle) <linux@armlinux.org.uk> Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://lore.kernel.org/r/20230720000231.1939689-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 7998c0a commit 1c613be

File tree

1 file changed

+14
-7
lines changed

1 file changed

+14
-7
lines changed

drivers/net/phy/phy_device.c

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3451,23 +3451,30 @@ static int __init phy_init(void)
34513451
{
34523452
int rc;
34533453

3454+
ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
3455+
34543456
rc = mdio_bus_init();
34553457
if (rc)
3456-
return rc;
3458+
goto err_ethtool_phy_ops;
34573459

3458-
ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
34593460
features_init();
34603461

34613462
rc = phy_driver_register(&genphy_c45_driver, THIS_MODULE);
34623463
if (rc)
3463-
goto err_c45;
3464+
goto err_mdio_bus;
34643465

34653466
rc = phy_driver_register(&genphy_driver, THIS_MODULE);
3466-
if (rc) {
3467-
phy_driver_unregister(&genphy_c45_driver);
3467+
if (rc)
3468+
goto err_c45;
3469+
3470+
return 0;
3471+
34683472
err_c45:
3469-
mdio_bus_exit();
3470-
}
3473+
phy_driver_unregister(&genphy_c45_driver);
3474+
err_mdio_bus:
3475+
mdio_bus_exit();
3476+
err_ethtool_phy_ops:
3477+
ethtool_set_ethtool_phy_ops(NULL);
34713478

34723479
return rc;
34733480
}

0 commit comments

Comments
 (0)