mv88e6xxx_mdio_read() applies the internal PHY model-number workaround
before returning a Clause 22 read error. Since the PHY read may leave
val untouched on failure, the workaround can consume an uninitialized
value.

Return the PHY read error immediately after dropping the register lock.
Successful reads continue through the workaround and return val as
before.

This issue was found by a static analysis checker and confirmed by
manual source review.

Assisted-by: unnamed:deepseek-v4-pro typestate
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>

---
Changes in v2:
- Return immediately on PHY read errors.
- Target net-next and drop the Fixes tag, as requested.
- Add the Assisted-by tag.

v1: https://lore.kernel.org/r/20260814134006.1386372-1-ruoyuw560@gmail.com/
---
 drivers/net/dsa/mv88e6xxx/chip.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 80b877c74513d6..432285e2881715 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -3769,6 +3769,9 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
 	err = chip->info->ops->phy_read(chip, bus, phy, reg, &val);
 	mv88e6xxx_reg_unlock(chip);
 
+	if (err)
+		return err;
+
 	/* Some internal PHYs don't have a model number. */
 	if (reg == MII_PHYSID2 && !(val & 0x3f0) &&
 	    chip->info->family < ARRAY_SIZE(family_prod_id_table)) {
@@ -3777,7 +3780,7 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg)
 			val |= prod_id >> 4;
 	}
 
-	return err ? err : val;
+	return val;
 }
 
 static int mv88e6xxx_mdio_read_c45(struct mii_bus *bus, int phy, int devad,
-- 
2.51.0

On 8/15/26 5:17 PM, Ruoyu Wang wrote:
> mv88e6xxx_mdio_read() applies the internal PHY model-number workaround
> before returning a Clause 22 read error. Since the PHY read may leave
> val untouched on failure, the workaround can consume an uninitialized
> value.
> 
> Return the PHY read error immediately after dropping the register lock.
> Successful reads continue through the workaround and return val as
> before.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.
> 
> Assisted-by: unnamed:deepseek-v4-pro typestate
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
## Form letter - net-next-closed

We have already submitted our pull request with net-next material for v7.3,
and therefore net-next is closed for new drivers, features, code refactoring
and optimizations. We are currently accepting bug fixes only.

Please repost when net-next reopens after Aug 31st.

RFC patches sent for review only are obviously welcome at any time.

See: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#development-cycle