github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

net: phy: unregister SFP upstream before port cleanup

Browse Source 
Commit 4497f50286 ("net: phy: Clean the phy_ports after unregistering
the downstream SFP bus") established that an SFP upstream must be
unregistered before its phy_ports are destroyed because SFP callbacks
may access these ports.

phy_setup_ports() does not follow this order when a later port setup
step fails after phy_sfp_probe() succeeds. It destroys the SFP phy_port
and leaves phy_probe() to unregister the upstream later, creating a race
between port destruction and SFP upstream callbacks.

The error unwind is also split across three functions. If
phy_setup_sfp_port() fails, phy_sfp_probe() leaves the upstream
registered and relies on phy_probe() to remove it after
phy_setup_ports() returns.

Make each layer unwind the resources it successfully set up. Unregister
only the upstream in phy_sfp_probe() when SFP port setup fails, since
the failed port has already been destroyed. Add phy_sfp_release() for a
successful SFP probe, and make phy_setup_ports() use it before cleaning
up the remaining ports. Once phy_setup_ports() has rolled back all port
setup, make phy_probe() skip this cleanup.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
Link: https://patch.msgid.link/20260823035600.188864-3-xuanqiang.luo@linux.dev
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Xuanqiang Luo 2026-08-23 11:55:56 +08:00 committed by Jakub Kicinski
parent b6d201d971
commit f558204abc
1 changed files with 38 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

49
drivers/net/phy/phy_device.c
View File

@ -1723,12 +1723,41 @@ static int phy_sfp_probe(struct phy_device *phydev)
phydev->sfp_bus = NULL;
}
if (!ret && phydev->sfp_bus)
if (!ret && phydev->sfp_bus) {
ret = phy_setup_sfp_port(phydev);
if (ret) {
sfp_bus_del_upstream(phydev->sfp_bus);
phydev->sfp_bus = NULL;
}
}
return ret;
}
/**
* phy_sfp_release - release resources set up by phy_sfp_probe()
* @phydev: the PHY device
*
* Release the SFP resources set up by a successful phy_sfp_probe(). Unregister
* the upstream before destroying its phy_port, so SFP upstream callbacks cannot
* race with port destruction.
*/
static void phy_sfp_release(struct phy_device *phydev)
{
struct phy_port *port, *tmp;
sfp_bus_del_upstream(phydev->sfp_bus);
phydev->sfp_bus = NULL;
list_for_each_entry_safe(port, tmp, &phydev->ports, head) {
if (!port->is_sfp)
continue;
phy_del_port(phydev, port);
phy_port_destroy(port);
}
}
static bool phy_drv_supports_irq(const struct phy_driver *phydrv)
{
return phydrv->config_intr && phydrv->handle_interrupt;
@ -3547,13 +3576,13 @@ static int phy_setup_ports(struct phy_device *phydev)
if (!phydev->is_genphy_driven) {
ret = phy_sfp_probe(phydev);
if (ret)
goto out;
goto err_ports;
}
if (phydev->n_ports < phydev->max_n_ports) {
ret = phy_default_setup_single_port(phydev);
if (ret)
goto out;
goto err_sfp;
}
linkmode_zero(ports_supported);
@ -3580,7 +3609,9 @@ static int phy_setup_ports(struct phy_device *phydev)
return 0;
out:
err_sfp:
phy_sfp_release(phydev);
err_ports:
phy_cleanup_ports(phydev);
return ret;
}
@ -3744,7 +3775,7 @@ static int phy_probe(struct device *dev)
err = phy_setup_ports(phydev);
if (err)
goto out_sfp_release;
goto out_reset;
phy_advertise_supported(phydev);
@ -3816,9 +3847,7 @@ static int phy_probe(struct device *dev)
phy_led_triggers_unregister(phydev);
out_sfp_release:
sfp_bus_del_upstream(phydev->sfp_bus);
phydev->sfp_bus = NULL;
phy_sfp_release(phydev);
phy_cleanup_ports(phydev);
out_reset:
@ -3842,9 +3871,7 @@ static int phy_remove(struct device *dev)
phydev->state = PHY_DOWN;
sfp_bus_del_upstream(phydev->sfp_bus);
phydev->sfp_bus = NULL;
phy_sfp_release(phydev);
phy_cleanup_ports(phydev);
if (phydev->drv && phydev->drv->remove)