net: phy: marvell10g: fix null pointer dereference

Commit c3e302edca24 ("net: phy: marvell10g: fix temperature sensor on 2110")
added a check for PHY ID via phydev->drv->phy_id in a function which is
called by devres at a time when phydev->drv is already set to null by
phy_remove function.

This null pointer dereference can be triggered via SFP subsystem with a
SFP module containing this Marvell PHY. When the SFP interface is put
down, the SFP subsystem removes the PHY.

Fixes: c3e302edca24 ("net: phy: marvell10g: fix temperature sensor on 2110")
Signed-off-by: Marek Behún <[e-mail]>
Cc: Maxime Chevallier <[e-mail]>
Cc: Andrew Lunn <[e-mail]>
Cc: Baruch Siach <[e-mail]>
Cc: Russell King <[e-mail]>
Signed-off-by: David S. Miller <[e-mail]>

drivers/net/phy/marvell10g.c

···
 			      MV_V2_TEMP_CTRL_MASK, val);
 }
 
-static void mv3310_hwmon_disable(void *data)
-{
-	struct phy_device *phydev = data;
-
-	mv3310_hwmon_config(phydev, false);
-}
-
 static int mv3310_hwmon_probe(struct phy_device *phydev)
 {
 	struct device *dev = &phydev->mdio.dev;
···
 	priv->hwmon_name[j] = '\0';
 
 	ret = mv3310_hwmon_config(phydev, true);
-	if (ret)
-		return ret;
-
-	ret = devm_add_action_or_reset(dev, mv3310_hwmon_disable, phydev);
 	if (ret)
 		return ret;
 
···
 		return ret;
 
 	return phy_sfp_probe(phydev, &mv3310_sfp_ops);
+}
+
+static void mv3310_remove(struct phy_device *phydev)
+{
+	mv3310_hwmon_config(phydev, false);
 }
 
 static int mv3310_suspend(struct phy_device *phydev)
···
 		.read_status	= mv3310_read_status,
 		.get_tunable	= mv3310_get_tunable,
 		.set_tunable	= mv3310_set_tunable,
+		.remove		= mv3310_remove,
 	},
 	{
 		.phy_id		= MARVELL_PHY_ID_88E2110,
···
 		.read_status	= mv3310_read_status,
 		.get_tunable	= mv3310_get_tunable,
 		.set_tunable	= mv3310_set_tunable,
+		.remove		= mv3310_remove,
 	},
 };