bus->read() returns a negative errno on failure, but mt7530_regmap_read() assigns it to a u16, truncating e.g. -ETIMEDOUT into 0xff92, and returns success. The garbage word is then consumed as register data, and read-modify-write cycles write it back to the switch. Check both reads and propagate their errors. The same defect existed in mt7530_mii_read() since the driver was introduced and moved into the regmap backend unchanged. core_rmw(), which accesses the MMD core registers directly rather than through the regmap, has the identical unchecked bus->read(); fix it the same way. Fixes: b8f126a8d543 ("net-next: dsa: add dsa support for Mediatek MT7530 switch") Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn --- v2: * also check the identical unchecked bus->read() in core_rmw() (found by Sashiko AI review) * split the mtk_pcs_lynxi_get_state() fix into its own patch drivers/net/dsa/mt7530-mdio.c | 11 +++++++++-- drivers/net/dsa/mt7530.c | 6 +++++- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/net/dsa/mt7530-mdio.c b/drivers/net/dsa/mt7530-mdio.c index 11ea924a9f35..784dd58a7158 100644 --- a/drivers/net/dsa/mt7530-mdio.c +++ b/drivers/net/dsa/mt7530-mdio.c @@ -55,8 +55,15 @@ mt7530_regmap_read(void *context, unsigned int reg, unsigned int *val) if (ret < 0) return ret; - lo = bus->read(bus, priv->mdiodev->addr, r); - hi = bus->read(bus, priv->mdiodev->addr, 0x10); + ret = bus->read(bus, priv->mdiodev->addr, r); + if (ret < 0) + return ret; + lo = ret; + + ret = bus->read(bus, priv->mdiodev->addr, 0x10); + if (ret < 0) + return ret; + hi = ret; *val = (hi << 16) | (lo & 0xffff); diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c index 3c2a3029b10c..f349b54c2d9e 100644 --- a/drivers/net/dsa/mt7530.c +++ b/drivers/net/dsa/mt7530.c @@ -124,8 +124,12 @@ core_rmw(struct mt7530_priv *priv, u32 reg, u32 mask, u32 set) goto err; /* Read the content of the MMD's selected register */ - val = bus->read(bus, MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr), + ret = bus->read(bus, MT753X_CTRL_PHY_ADDR(priv->mdiodev->addr), MII_MMD_DATA); + if (ret < 0) + goto err; + val = ret; + val &= ~mask; val |= set; /* Write the data into MMD's selected register */ -- 2.55.0