Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Vicente Bergas <vicencb@gmail.com>
To:     Serge Semin <fancer.lancer@gmail.com>,
        Russell King <rmk+kernel@armlinux.org.uk>,
        Andrew Lunn <andrew@lunn.ch>,
        Florian Fainelli <f.fainelli@gmail.com>,
        Heiner Kallweit <hkallweit1@gmail.com>
Cc:     <netdev@vger.kernel.org>, <linux-kernel@vger.kernel.org>
Subject: net: phy: realtek: regression, kernel null pointer dereference
Date:   Fri, 10 May 2019 17:05:13 +0200
MIME-Version: 1.0
Message-ID: <16f75ff4-e3e3-4d96-b084-e772e3ce1c2b@gmail.com>
User-Agent: Trojita
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hello,
there is a regression on linux v5.1-9573-gb970afcfcabd with a kernel null
pointer dereference.
The issue is the commit f81dadbcf7fd067baf184b63c179fc392bdb226e
  net: phy: realtek: Add rtl8211e rx/tx delays config
which uncovered a bug in phy-core when attempting to call
  phydev->drv->read_page
which can be null.
The patch to drivers/net/phy/phy-core.c below fixes the kernel null pointer
dereference. After applying the patch, there is still no network. I have
also tested the patch to drivers/net/phy/realtek.c, but no success. The
system hangs forever while initializing eth0.

Any suggestions?

Regards,
  Vicen=C3=A7.

--- a/drivers/net/phy/phy-core.c
+++ b/drivers/net/phy/phy-core.c
@@ -648,11 +648,17 @@
=20
 static int __phy_read_page(struct phy_device *phydev)
 {
+=09if (!phydev->drv->read_page)
+=09=09return -EOPNOTSUPP;
+=09
 =09return phydev->drv->read_page(phydev);
 }
=20
 static int __phy_write_page(struct phy_device *phydev, int page)
 {
+=09if (!phydev->drv->write_page)
+=09=09return -EOPNOTSUPP;
+
 =09return phydev->drv->write_page(phydev, page);
 }
--- a/drivers/net/phy/realtek.c
+++ b/drivers/net/phy/realtek.c
@@ -214,8 +214,10 @@
 =09 * for details).
 =09 */
 =09oldpage =3D phy_select_page(phydev, 0x7);
-=09if (oldpage < 0)
-=09=09goto err_restore_page;
+=09if (oldpage < 0) {
+=09=09dev_warn(&phydev->mdio.dev, "Unable to set rgmii delays\n");
+=09=09return 0;
+=09}
=20
 =09ret =3D phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
 =09if (ret)