Re: [PATCH net-next v8 4/9] net: mdio: realtek-rtl9300: extend controller structure lifetime

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Calling devm_add_action_or_reset() on the uninitialized &bus->dev causes a guaranteed NULL pointer dereference, and on error paths leaks resources.
--

--- Patch [4]: [PATCH net-next v8 4/9] net: mdio: realtek-rtl9300: extend controller structure lifetime ---
commit 34bdc9b9e9ece2a1428b242a3ed3e140500fd37f
Author: Markus Stockhausen <markus.stockhausen@gmx.de>

net: mdio: realtek-rtl9300: extend controller structure lifetime

This patch changes the allocation of the otto_emdio_priv structure from
devm_kzalloc() to kzalloc() and introduces a kref counter. It attempts to
decouple the controller's lifetime from the platform device by tying it
to the registered MDIO buses via devm_add_action_or_reset().

> diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
> index 73ac5fdcd2674..3b99978a2511e 100644
> --- a/drivers/net/mdio/mdio-realtek-rtl9300.c
> +++ b/drivers/net/mdio/mdio-realtek-rtl9300.c
[ ... ]
> @@ -617,6 +634,11 @@ static int otto_emdio_probe_one(struct device *dev, struct otto_emdio_priv *priv
>  
>  	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-%d", dev_name(dev), mdio_bus);
>  
> +	kref_get(&priv->kref);
> +	err = devm_add_action_or_reset(&bus->dev, otto_emdio_cleanup_bus, priv);

[Severity: Critical]
Will this cause a list corruption crash unconditionally on every probe?

The bus structure is allocated via devm_mdiobus_alloc_size(), which returns
zero-initialized memory, meaning bus->dev.devres_head is uninitialized.
Calling devm_add_action_or_reset() here will attempt to append to this
zero-initialized list.

Additionally, if the crash is bypassed, devm_of_mdiobus_register() later
calls device_initialize(&bus->dev). This resets devres_head to empty,
destroying the action and leaking the kref.

Finally, if mdiobus_register() is never reached on an error path,
mdiobus_free() handles the MDIOBUS_ALLOCATED state by directly calling
kfree(bus). This bypasses device_release() and devres_release_all(),
permanently leaking the devres structure and the priv kref.

> +	if (err)
> +		return dev_err_probe(dev, err, "cannot register cleanup action\n");
> +
>  	err = devm_of_mdiobus_register(dev, bus, to_of_node(node));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260729160227.155613-1-markus.stockhausen@gmx.de?part=4