github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: phy: put the driver module the attach took

Browse Source 
phy_attach_direct() pins the PHY driver module through d->driver, and
phy_detach() releases it by reading d->driver again. Unbinding the PHY
driver while the PHY is attached clears that pointer, so a detach that
runs while the driver is still unbound skips the put and the module can
no longer be unloaded; if a different driver binds in between, the put
lands on a module that was never pinned. The NULL test added by
commit c2b727df7c ("net: phy: Avoid NPD upon phy_detach() when driver
is unbound") avoids the oops but skips the put.

Found by reading phy_detach() while chasing a PHY driver unbind race on
a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak
itself was not observed there: unbinding air_en8811h under the attached
lan4 DSA port and then unbinding the switch faults earlier on that
board, in phy_free_interrupt() or under phy_stop(), before
phy_detach() gets to the put.

Remember which module was pinned and release that one.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Link: https://patch.msgid.link/20261013151200.2473464-3-f@lex.la
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Aleksei Sviridkin 2026-10-13 18:12:00 +03:00 committed by Jakub Kicinski
parent fa38468cd2
commit 7151b86654
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/phy/phy_device.c
View File

@ -1728,8 +1728,8 @@ static void phy_detach_internal(struct phy_device *phydev, bool notify_bus)
phydev->phy_link_change = NULL;
phydev->phylink = NULL;
if (phydev->mdio.dev.driver)
module_put(phydev->mdio.dev.driver->owner);
module_put(phydev->drv_owner);
phydev->drv_owner = NULL;
/* If the device had no specific driver before (i.e. - it
* was using the generic driver), we unbind the device
@ -1794,6 +1794,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
struct mii_bus *bus = phydev->mdio.bus;
struct device *d = &phydev->mdio.dev;
struct module *ndev_owner = NULL;
struct module *drv_owner;
int irq = phydev->irq;
int err;
@ -1830,11 +1831,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
phydev->is_genphy_driven = 1;
}
if (!try_module_get(d->driver->owner)) {
drv_owner = d->driver->owner;
if (!try_module_get(drv_owner)) {
phydev_err(phydev, "failed to get the device driver module\n");
err = -EIO;
goto error_put_device;
}
phydev->drv_owner = drv_owner;
if (phydev->is_genphy_driven) {
err = d->driver->probe(d);
@ -1942,7 +1945,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
return err;
error_module_put:
module_put(d->driver->owner);
module_put(phydev->drv_owner);
phydev->drv_owner = NULL;
phydev->irq = irq;
phydev->is_genphy_driven = 0;
d->driver = NULL;

2
include/linux/phy.h
View File

@ -578,6 +578,7 @@ struct phy_oatc14_sqi_capability {
*
* @mdio: MDIO bus this PHY is on
* @drv: Pointer to the driver for this PHY instance
* @drv_owner: Driver module phy_attach_direct() took a reference on
* @devlink: Create a link between phy dev and mac dev, if the external phy
* used by current mac interface is managed by another mac interface.
* @phyindex: Unique id across the phy's parent tree of phys to address the PHY
@ -689,6 +690,7 @@ struct phy_device {
/* Information about the PHY type */
/* And management functions */
const struct phy_driver *drv;
struct module *drv_owner;
struct device_link *devlink;