All of lore.kernel.org
 help / color / mirror / Atom feed
From: Carlo Szelinsky <github@szelinsky.de>
To: Aleksander Jan Bajkowski <olek2@wp.pl>,
	Oleksij Rempel <o.rempel@pengutronix.de>,
	Kory Maincent <kory.maincent@bootlin.com>,
	Andrew Lunn <andrew+netdev@lunn.ch>,
	Heiner Kallweit <hkallweit1@gmail.com>,
	Russell King <linux@armlinux.org.uk>,
	"David S . Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Corey Leavitt <corey@leavitt.info>,
	Jonas Jelonek <jelonek.jonas@gmail.com>,
	Simon Horman <horms@kernel.org>,
	netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
	Carlo Szelinsky <github@szelinsky.de>
Subject: Re: [PATCH net-next v4 3/3] net: phy: own phydev->psec via PSE notifier and remove fwnode_mdio hook
Date: Sun, 23 Aug 2026 19:09:21 +0200	[thread overview]
Message-ID: <20260823170921.1429827-1-github@szelinsky.de> (raw)
In-Reply-To: <bac5e6e9-7358-4ccb-87fc-9c40baa33682@wp.pl>

> This patch causes a deadlock with the etop driver (lantiq arx100 soc
> family).

Thanks Aleksander, and thanks for testing it on real hardware. It's a real
deadlock and you're right about the cause.

The cause is that this patch makes phy_device_register() take rtnl_lock()
around the psec attach. etop registers its MDIO bus from ndo_init
(ltq_etop_mdio_init -> mdiobus_register -> mdiobus_scan ->
phy_device_register), and ndo_init already runs under rtnl inside
register_netdevice(). So the second rtnl_lock() deadlocks. It only shows up
on drivers that register the bus from ndo_init - most do it from probe,
outside rtnl - which is why it didn't turn up here earlier.

I don't think we should revert. As Jonas said, this should be fixed in the
patch. My idea for the next version is to stop using rtnl for the psec
attach/detach and use a small dedicated mutex instead. A private lock can't
recurse against the caller's rtnl, so the etop case would go away.

Kory, others - does that sound like the right direction to you?

One thing I want to flag: rtnl there wasn't only guarding the attach, it was
also keeping the ethtool code that reads phydev->psec from racing the detach
that frees it. So the mutex would need to sit in two places - the phy side and
the ethtool paths in net/ethtool/pse-pd.c - otherwise the deadlock is gone but
the use-after-free comes back. Just so we pick the right approach.

Thanks,
Carlo

  reply	other threads:[~2026-08-23 17:09 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-06-30  9:11 [PATCH net-next v4 0/3] net: pse-pd: decouple controller lookup from MDIO probe Carlo Szelinsky
2026-06-30  9:11 ` [PATCH net-next v4 1/3] net: pse-pd: add notifier chain for controller lifecycle events Carlo Szelinsky
2026-06-30  9:11 ` [PATCH net-next v4 2/3] net: pse-pd: fire lifecycle events on controller register/unregister Carlo Szelinsky
2026-06-30  9:11 ` [PATCH net-next v4 3/3] net: phy: own phydev->psec via PSE notifier and remove fwnode_mdio hook Carlo Szelinsky
2026-07-03  7:10   ` Paolo Abeni
2026-07-03 21:06     ` Carlo Szelinsky
2026-08-21 12:33   ` Aleksander Jan Bajkowski
2026-08-23 17:09     ` Carlo Szelinsky [this message]
2026-08-24 13:20       ` Kory Maincent

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260823170921.1429827-1-github@szelinsky.de \
    --to=github@szelinsky.de \
    --cc=andrew+netdev@lunn.ch \
    --cc=corey@leavitt.info \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=hkallweit1@gmail.com \
    --cc=horms@kernel.org \
    --cc=jelonek.jonas@gmail.com \
    --cc=kory.maincent@bootlin.com \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@armlinux.org.uk \
    --cc=netdev@vger.kernel.org \
    --cc=o.rempel@pengutronix.de \
    --cc=olek2@wp.pl \
    --cc=pabeni@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.