On Thu, Jun 07, 2018 at 10:53:46AM -0500, Brandon Maier wrote:
Since a phy_device is added to the global mdio_bus list during
phy_device_register(), but a phy_device's phy_driver doesn't get
attached until phy_probe(). It's possible of_phy_find_device() in
xgmiitorgmii will return a valid phy with a NULL phy_driver. Leading to
a NULL pointer access during the memcpy().
I'm sure there are more issues like this in the code. e.g. there is
no attempt made to hold a reference to the child phy. So it could be
unbound. priv->phy_drv->read_status(phydev) is then going to do bad
things.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew