git.openwrt.org Git - openwrt/openwrt.git/blob

   1 From 0c16deea166f6d890ac4aa9a73d28fc64fb26c3d Mon Sep 17 00:00:00 2001
   2 From: Alexandru Gagniuc <mr.nuke.me@gmail.com>
   3 Date: Sat, 10 May 2025 14:59:05 -0500
   4 Subject: [PATCH] net: pcs: ipq-uniphy: fix NULL pointer dereference in probe()
   5
   6 In .probe(), the clocks are stored one-by-one in the priv->clk[]
   7 array. Later, they are dereferenced directly when calling
   8 clk_set_rate(). When the clock value is PTR_ERR instead of a valid
   9 pointer, the system crashes with a NULL pointer dereference.
  10
  11 The problem is seen on IPQ9554, where uniphy1 is not present, and
  12 cannot be enabled:
  13
  14     gcc_uniphy1_sys_clk status stuck at 'off'
  15     ...
  16     ipq_uniphy 7a10000.ethernet-uniphy: Failed to get the clock ID sys
  17     ...
  18     Unable to handle kernel read from unreadable memory at virtual address 000000000000002
  19
  20 While disabling the uniphy1 node in devicetree also prevents the
  21 crash, fixing the driver logic is more generic. Abort .probe() if any
  22 of the clocks fail to resolve.
  23
  24 Signed-off-by: Alexandru Gagniuc <mr.nuke.me@gmail.com>
  25 ---
  26  drivers/net/pcs/pcs-qcom-ipq-uniphy.c | 4 +++-
  27  1 file changed, 3 insertions(+), 1 deletion(-)
  28
  29 --- a/drivers/net/pcs/pcs-qcom-ipq-uniphy.c
  30 +++ b/drivers/net/pcs/pcs-qcom-ipq-uniphy.c
  31 @@ -1167,9 +1167,11 @@ static int ipq_uniphy_probe(struct platf
  32                 priv->clk[i] = devm_clk_get_optional_enabled(dev,
  33                                                              pcs_clock_name[i]);
  34
  35 -               if (IS_ERR(priv->clk[i]))
  36 +               if (IS_ERR(priv->clk[i])) {
  37                         dev_err(dev, "Failed to get the clock ID %s\n",
  38                                 pcs_clock_name[i]);
  39 +                       return PTR_ERR(priv->clk[i]);
  40 +               }
  41         }
  42
  43         for (i = 0; i < PCS_RESET_MAX; i++) {