Re: [PATCH net-next v7 4/8] net: mdio: realtek-rtl9300: Configure hardware polling during probing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Use-After-Free in `otto_emdio_notify_phy_detach` due to devm lifetime mismatch.
--

--- Patch [4]: [PATCH net-next v7 4/8] net: mdio: realtek-rtl9300: Configure hardware polling during probing ---
commit 66c265d23ecd919426f5681d91b6f6d07bc6bd53
Author: Markus Stockhausen <markus.stockhausen@gmx.de>

net: mdio: realtek-rtl9300: Configure hardware polling during probing

This patch configures hardware polling for Realtek Otto switches to prevent
interference during PHY probing and firmware loading. It disables polling
when the MDIO driver starts, reenables it after a PHY is attached, and
disables it before a PHY is detached.

> diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
> index 3dee5bff41349..c607dad9f0a31 100644
> --- a/drivers/net/mdio/mdio-realtek-rtl9300.c
> +++ b/drivers/net/mdio/mdio-realtek-rtl9300.c

[ ... ]

> @@ -582,6 +591,32 @@ static int otto_emdio_9310_setup_controller(struct otto_emdio_priv *priv)
>  	return 0;
>  }
>  
> +static int otto_emdio_notify_phy_attach(struct phy_device *phydev)
> +{

[ ... ]

> +}
> +
> +static void otto_emdio_notify_phy_detach(struct phy_device *phydev)
> +{
> +	struct otto_emdio_priv *priv = otto_emdio_bus_to_priv(phydev->mdio.bus);
> +	int port = otto_emdio_phy_to_port(phydev->mdio.bus, phydev->mdio.addr);
> +	struct mii_bus *bus = phydev->mdio.bus;
> +	int ret;
> +
> +	if (port < 0)
> +		return;
> +
> +	ret = otto_emdio_set_port_polling(priv, port, false);

[Severity: High]
Could this lead to a use-after-free if the MDIO driver is unbound?

The priv structure is allocated with devm_kzalloc() during probe, which
ties its lifetime to the platform device. However, the MDIO bus is allocated
with devm_mdiobus_alloc_size(), which is reference counted.

If the MDIO driver is unbound via sysfs, devres will free priv immediately.
If a MAC driver still holds a reference to a PHY device on the bus, the
mii_bus will remain alive.

When the MAC driver later detaches the PHY, for example when the network
interface is brought down, phy_detach() will call bus->notify_phy_detach().
This executes otto_emdio_notify_phy_detach(), which will dereference the
freed priv pointer inside otto_emdio_set_port_polling().

> +	if (ret)
> +		dev_err(bus->parent, "failed to disable polling for port %d\n", port);
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260726071751.1359156-1-markus.stockhausen@gmx.de?part=4