dp83848_config_init() reads BMCR to detect whether auto-negotiation is
enabled, but does not check the phy_read() return value. On an MDIO read
failure phy_read() returns a negative errno, which is then used directly
in a bitwise test; the auto-negotiation state is left undefined while
config_init() still reports success.

Check the return value and propagate the error.

Fixes: b718e8c8f4f5 ("net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
---
Only compile-tested; I do not have DP83848-family hardware.

 drivers/net/phy/dp83848.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
index d88b1999d596..e65651ac567a 100644
--- a/drivers/net/phy/dp83848.c
+++ b/drivers/net/phy/dp83848.c
@@ -117,6 +117,9 @@ static int dp83848_config_init(struct phy_device *phydev)
 	 * we check initial value of BMCR Auto negotiation enable bit
 	 */
 	val = phy_read(phydev, MII_BMCR);
+	if (val < 0)
+		return val;
+
 	if (!(val & BMCR_ANENABLE))
 		phydev->autoneg = AUTONEG_DISABLE;
 

base-commit: 70f3995830d3f1e79faa14eb0605914f778feca9
-- 
2.53.0

在 2026/9/2 14:58, Donggeun Yoo 写道:
> dp83848_config_init() reads BMCR to detect whether auto-negotiation is
> enabled, but does not check the phy_read() return value. On an MDIO read
> failure phy_read() returns a negative errno, which is then used directly
> in a bitwise test; the auto-negotiation state is left undefined while
> config_init() still reports success.
>
> Check the return value and propagate the error.
>
> Fixes: b718e8c8f4f5 ("net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620")
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>

Reviewed-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>

Thanks,
Xuanqiang

Hi,

On 9/2/26 08:58, Donggeun Yoo wrote:
> dp83848_config_init() reads BMCR to detect whether auto-negotiation is
> enabled, but does not check the phy_read() return value. On an MDIO read
> failure phy_read() returns a negative errno, which is then used directly
> in a bitwise test; the auto-negotiation state is left undefined while
> config_init() still reports success.
> 
> Check the return value and propagate the error.
> 
> Fixes: b718e8c8f4f5 ("net: phy: dp83822: use BMCR_ANENABLE instead of BMSR_ANEGCAPABLE for DP83620")
> Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Maxime

> ---
> Only compile-tested; I do not have DP83848-family hardware.
> 
>  drivers/net/phy/dp83848.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/phy/dp83848.c b/drivers/net/phy/dp83848.c
> index d88b1999d596..e65651ac567a 100644
> --- a/drivers/net/phy/dp83848.c
> +++ b/drivers/net/phy/dp83848.c
> @@ -117,6 +117,9 @@ static int dp83848_config_init(struct phy_device *phydev)
>  	 * we check initial value of BMCR Auto negotiation enable bit
>  	 */
>  	val = phy_read(phydev, MII_BMCR);
> +	if (val < 0)
> +		return val;
> +
>  	if (!(val & BMCR_ANENABLE))
>  		phydev->autoneg = AUTONEG_DISABLE;
>  
> 
> base-commit: 70f3995830d3f1e79faa14eb0605914f778feca9