An SMI timeout or PPU access failure can make a Clause 22 PHY read
return without initializing its output value. When reading MII_PHYSID2,
mv88e6xxx_mdio_read() still passes that value through the internal PHY
model-number workaround before returning the error, causing an
uninitialized stack read.

Run the workaround only after a successful PHY read. This preserves the
original error and leaves successful PHY ID reads unchanged.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: da9f33018e2c ("net: dsa: mv88e6xxx: Workaround missing PHY ID on mv88e6390")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 80b877c74513d..e71707ce71cbc 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3770,7 +3770,7 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
 	mv88e6xxx_reg_unlock(chip);
 
 	/* Some internal PHYs don't have a model number. */
-	if (reg == MII_PHYSID2 && !(val & 0x3f0) &&
+	if (!err && reg == MII_PHYSID2 && !(val & 0x3f0) &&
 	    chip->info->family < ARRAY_SIZE(family_prod_id_table)) {
 		prod_id = family_prod_id_table[chip->info->family];
 		if (prod_id)
-- 
2.51.0

On Fri, Aug 14, 2026 at 09:40:06PM +0800, Ruoyu Wang wrote:
> An SMI timeout or PPU access failure can make a Clause 22 PHY read
> return without initializing its output value. When reading MII_PHYSID2,
> mv88e6xxx_mdio_read() still passes that value through the internal PHY
> model-number workaround before returning the error, causing an
> uninitialized stack read.
> 
> Run the workaround only after a successful PHY read. This preserves the
> original error and leaves successful PHY ID reads unchanged.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Fixes: da9f33018e2c ("net: dsa: mv88e6xxx: Workaround missing PHY ID on mv88e6390")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
>  drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
> index 80b877c74513d..e71707ce71cbc 100644
> --- a/drivers/net/dsa/mv88e6xxx/chip.c
> +++ b/drivers/net/dsa/mv88e6xxx/chip.c
> @@ -3770,7 +3770,7 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
>  	mv88e6xxx_reg_unlock(chip);
>  
>  	/* Some internal PHYs don't have a model number. */
> -	if (reg == MII_PHYSID2 && !(val & 0x3f0) &&
> +	if (!err && reg == MII_PHYSID2 && !(val & 0x3f0) &&
>  	    chip->info->family < ARRAY_SIZE(family_prod_id_table)) {
>  		prod_id = family_prod_id_table[chip->info->family];
>  		if (prod_id)

Ugly.

Please do the usual for checking for errors and returning.

Also, this is not worthy of stable, please drop the Fixes tag, and
post to net-next.

       Andrew