[PATCH 5.8 395/464] net: phy: marvell10g: fix null pointer dereference

[Greg Kroah-Hartman]

From: "Marek Behún" <marek.be...@nic.cz>

[ Upstream commit 1b8ef1423dbfd34de2439a2db457b84480b7c8a8 ]

Commit c3e302edca24 ("net: phy: marvell10g: fix temperature sensor on 2110")
added a check for PHY ID via phydev->drv->phy_id in a function which is
called by devres at a time when phydev->drv is already set to null by
phy_remove function.

This null pointer dereference can be triggered via SFP subsystem with a
SFP module containing this Marvell PHY. When the SFP interface is put
down, the SFP subsystem removes the PHY.

Fixes: c3e302edca24 ("net: phy: marvell10g: fix temperature sensor on 2110")
Signed-off-by: Marek Behún <marek.be...@nic.cz>
Cc: Maxime Chevallier <maxime.chevall...@bootlin.com>
Cc: Andrew Lunn <and...@lunn.ch>
Cc: Baruch Siach <bar...@tkos.co.il>
Cc: Russell King <rmk+ker...@armlinux.org.uk>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 drivers/net/phy/marvell10g.c |   18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

--- a/drivers/net/phy/marvell10g.c
+++ b/drivers/net/phy/marvell10g.c
@@ -205,13 +205,6 @@ static int mv3310_hwmon_config(struct ph
                              MV_V2_TEMP_CTRL_MASK, val);
 }
 
-static void mv3310_hwmon_disable(void *data)
-{
-       struct phy_device *phydev = data;
-
-       mv3310_hwmon_config(phydev, false);
-}
-
 static int mv3310_hwmon_probe(struct phy_device *phydev)
 {
        struct device *dev = &phydev->mdio.dev;
@@ -235,10 +228,6 @@ static int mv3310_hwmon_probe(struct phy
        if (ret)
                return ret;
 
-       ret = devm_add_action_or_reset(dev, mv3310_hwmon_disable, phydev);
-       if (ret)
-               return ret;
-
        priv->hwmon_dev = devm_hwmon_device_register_with_info(dev,
                                priv->hwmon_name, phydev,
                                &mv3310_hwmon_chip_info, NULL);
@@ -423,6 +412,11 @@ static int mv3310_probe(struct phy_devic
        return phy_sfp_probe(phydev, &mv3310_sfp_ops);
 }
 
+static void mv3310_remove(struct phy_device *phydev)
+{
+       mv3310_hwmon_config(phydev, false);
+}
+
 static int mv3310_suspend(struct phy_device *phydev)
 {
        return mv3310_power_down(phydev);
@@ -762,6 +756,7 @@ static struct phy_driver mv3310_drivers[
                .read_status    = mv3310_read_status,
                .get_tunable    = mv3310_get_tunable,
                .set_tunable    = mv3310_set_tunable,
+               .remove         = mv3310_remove,
        },
        {
                .phy_id         = MARVELL_PHY_ID_88E2110,
@@ -776,6 +771,7 @@ static struct phy_driver mv3310_drivers[
                .read_status    = mv3310_read_status,
                .get_tunable    = mv3310_get_tunable,
                .set_tunable    = mv3310_set_tunable,
+               .remove         = mv3310_remove,
        },
 };