From fa38468cd26b4db34ab2b335f1904c19721f94b8 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 13 Oct 2026 18:11:59 +0300 Subject: [PATCH 1/2] net: phy: refuse a second attach before touching the PHY phy_attach_direct() tests phydev->attached_dev only after it has taken the driver module and, for a PHY with no driver, bound the generic one, and then leaves through the error path that calls phy_detach_internal(). That call works on the PHY's current attachment, so a second attach of a PHY in use tears down the first consumer: it clears that netdev's phydev pointer and the PHY's attached_dev, removes the sysfs links and suspends the PHY, while the first consumer goes on using it. A PHY on the generic driver never reaches the test: the attach runs its probe again and, when the bind fails, clears d->driver under the first consumer. Found in review of a change that makes phy_detach() put only the module the attach recorded: with it, this path leaves the first consumer's reference pinned. On a Keenetic KN-1012, a test module attaching a second netdev to the EN8811H that the lan4 DSA port holds got -EBUSY and left lan4 with no PHY; with this change lan4 kept it. Test whether the PHY is attached before the driver module is taken or the generic driver bound, and refuse from there. A PHY attached without a netdev, as DSA does for its CPU and link ports, has no attached_dev, so test phy_link_change, which every attach sets and every detach clears. A second attach of such a PHY used to succeed and share it; with that change it would also leak a module reference. Signed-off-by: Aleksei Sviridkin Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20261013151200.2473464-2-f@lex.la Signed-off-by: Jakub Kicinski --- drivers/net/phy/phy_device.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index bfce8b893644..6bc9cdb7fa69 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1811,6 +1811,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, get_device(d); + /* Set by every attach, with or without a netdev */ + if (phydev->phy_link_change) { + phydev_err(phydev, "PHY already attached\n"); + err = -EBUSY; + goto error_put_device; + } + /* Assume that if there is no driver, that it doesn't * exist, and we should use the genphy driver. */ @@ -1838,12 +1845,6 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, goto error_module_put; } - if (phydev->attached_dev) { - dev_err(&dev->dev, "PHY already attached\n"); - err = -EBUSY; - goto error; - } - phydev->phy_link_change = phy_link_change; if (dev) { phydev->attached_dev = dev; From 7151b86654fa635101cabe7f55511f54c3adcf84 Mon Sep 17 00:00:00 2001 From: Aleksei Sviridkin Date: Tue, 13 Oct 2026 18:12:00 +0300 Subject: [PATCH 2/2] net: phy: put the driver module the attach took phy_attach_direct() pins the PHY driver module through d->driver, and phy_detach() releases it by reading d->driver again. Unbinding the PHY driver while the PHY is attached clears that pointer, so a detach that runs while the driver is still unbound skips the put and the module can no longer be unloaded; if a different driver binds in between, the put lands on a module that was never pinned. The NULL test added by commit c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver is unbound") avoids the oops but skips the put. Found by reading phy_detach() while chasing a PHY driver unbind race on a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak itself was not observed there: unbinding air_en8811h under the attached lan4 DSA port and then unbinding the switch faults earlier on that board, in phy_free_interrupt() or under phy_stop(), before phy_detach() gets to the put. Remember which module was pinned and release that one. Reviewed-by: Andrew Lunn Signed-off-by: Aleksei Sviridkin Link: https://patch.msgid.link/20261013151200.2473464-3-f@lex.la Signed-off-by: Jakub Kicinski --- drivers/net/phy/phy_device.c | 12 ++++++++---- include/linux/phy.h | 2 ++ 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 6bc9cdb7fa69..68691c487eee 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1728,8 +1728,8 @@ static void phy_detach_internal(struct phy_device *phydev, bool notify_bus) phydev->phy_link_change = NULL; phydev->phylink = NULL; - if (phydev->mdio.dev.driver) - module_put(phydev->mdio.dev.driver->owner); + module_put(phydev->drv_owner); + phydev->drv_owner = NULL; /* If the device had no specific driver before (i.e. - it * was using the generic driver), we unbind the device @@ -1794,6 +1794,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, struct mii_bus *bus = phydev->mdio.bus; struct device *d = &phydev->mdio.dev; struct module *ndev_owner = NULL; + struct module *drv_owner; int irq = phydev->irq; int err; @@ -1830,11 +1831,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, phydev->is_genphy_driven = 1; } - if (!try_module_get(d->driver->owner)) { + drv_owner = d->driver->owner; + if (!try_module_get(drv_owner)) { phydev_err(phydev, "failed to get the device driver module\n"); err = -EIO; goto error_put_device; } + phydev->drv_owner = drv_owner; if (phydev->is_genphy_driven) { err = d->driver->probe(d); @@ -1942,7 +1945,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, return err; error_module_put: - module_put(d->driver->owner); + module_put(phydev->drv_owner); + phydev->drv_owner = NULL; phydev->irq = irq; phydev->is_genphy_driven = 0; d->driver = NULL; diff --git a/include/linux/phy.h b/include/linux/phy.h index 7c5098a0dd6c..a5a419bc400e 100644 --- a/include/linux/phy.h +++ b/include/linux/phy.h @@ -578,6 +578,7 @@ struct phy_oatc14_sqi_capability { * * @mdio: MDIO bus this PHY is on * @drv: Pointer to the driver for this PHY instance + * @drv_owner: Driver module phy_attach_direct() took a reference on * @devlink: Create a link between phy dev and mac dev, if the external phy * used by current mac interface is managed by another mac interface. * @phyindex: Unique id across the phy's parent tree of phys to address the PHY @@ -689,6 +690,7 @@ struct phy_device { /* Information about the PHY type */ /* And management functions */ const struct phy_driver *drv; + struct module *drv_owner; struct device_link *devlink;