Hello Dan,

On Tue, 27 Aug 2024 11:27:48 +0300
Dan Carpenter [off-list ref] wrote:

On Tue, Aug 27, 2024 at 07:33:59AM +0200, Maxime Chevallier wrote:

quoted

This issue has indeed been detected, and is being addressed, see :

https://lore.kernel.org/netdev/20240826134656.94892-1-djahchankoike@gmail.com/ (local)
  

There is a similar bug in ethnl_act_cable_test_tdr() that needs to be fixed
as well.

net/ethtool/cabletest.c
   307  int ethnl_act_cable_test_tdr(struct sk_buff *skb, struct genl_info *info)
   308  {
   309          struct ethnl_req_info req_info = {};
   310          const struct ethtool_phy_ops *ops;
   311          struct nlattr **tb = info->attrs;
   312          struct phy_device *phydev;
   313          struct phy_tdr_config cfg;
   314          struct net_device *dev;
   315          int ret;
   316  
   317          ret = ethnl_parse_header_dev_get(&req_info,
   318                                           tb[ETHTOOL_A_CABLE_TEST_TDR_HEADER],
   319                                           genl_info_net(info), info->extack,
   320                                           true);
   321          if (ret < 0)
   322                  return ret;
   323  
   324          dev = req_info.dev;
   325  
   326          ret = ethnl_act_cable_test_tdr_cfg(tb[ETHTOOL_A_CABLE_TEST_TDR_CFG],
   327                                             info, &cfg);
   328          if (ret)
   329                  goto out_dev_put;
   330  
   331          rtnl_lock();
                ^^^^^^^^^^^^

   332          phydev = ethnl_req_get_phydev(&req_info,
   333                                        tb[ETHTOOL_A_CABLE_TEST_TDR_HEADER],
   334                                        info->extack);
   335          if (!IS_ERR_OR_NULL(phydev)) {
                    ^
This test is reversed so it will lead to a crash.

Could you add some comments to ethnl_req_get_phydev() what the NULL return
means vs the error pointers?  I figured it out because the callers have comments
but it should be next to ethnl_req_get_phydev() as well.

Good catch ! I'll send some followup to address this report as
well as update the doc.

Thanks,

Maxime