An SMI timeout or PPU access failure can make a Clause 22 PHY read return without initializing its output value. When reading MII_PHYSID2, mv88e6xxx_mdio_read() still passes that value through the internal PHY model-number workaround before returning the error, causing an uninitialized stack read. Run the workaround only after a successful PHY read. This preserves the original error and leaves successful PHY ID reads unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: da9f33018e2c ("net: dsa: mv88e6xxx: Workaround missing PHY ID on mv88e6390") Signed-off-by: Ruoyu Wang --- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c index 80b877c74513d..e71707ce71cbc 100644 --- a/drivers/net/dsa/mv88e6xxx/chip.c +++ b/drivers/net/dsa/mv88e6xxx/chip.c @@ -3770,7 +3770,7 @@ static int mv88e6xxx_mdio_read(struct mii_bus *bus, int phy, int reg) mv88e6xxx_reg_unlock(chip); /* Some internal PHYs don't have a model number. */ - if (reg == MII_PHYSID2 && !(val & 0x3f0) && + if (!err && reg == MII_PHYSID2 && !(val & 0x3f0) && chip->info->family < ARRAY_SIZE(family_prod_id_table)) { prod_id = family_prod_id_table[chip->info->family]; if (prod_id) -- 2.51.0