Re: [PATCH 2/3] phy: core: Add common helper for get phy phandle by index

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing race condition where the PHY module and device references are temporarily dropped before being re-acquired, risking a use-after-free.
--

commit 21ec40d6cb3e559164837267cde1582380a6bfd2
Author: Inochi Amaoto <inochiama@gmail.com>

phy: core: Add common helper for get phy phandle by index

This commit refactors phy lookup by extracting the index-based retrieval
logic from of_phy_get() and devm_of_phy_get_by_index() into a new common
helper function, of_phy_get_by_index().

> diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
> index 451f8f0644c13..2259f0dff0822 100644
> --- a/drivers/phy/phy-core.c
> +++ b/drivers/phy/phy-core.c
[ ... ]
> -struct phy *of_phy_get(struct device_node *np, const char *con_id)
> +static struct phy *of_phy_get_by_index(struct device_node *np, int index)
>  {
> -	struct phy *phy = NULL;
> -	int index = 0;
> -
> -	if (con_id)
> -		index = of_property_match_string(np, "phy-names", con_id);
> +	struct phy *phy;
>  
>  	phy = _of_phy_get(np, index);
>  	if (IS_ERR(phy))

[Severity: High]
This isn't a bug introduced by this patch, but is there a race condition
here that could lead to a use-after-free?

Looking at the full body of of_phy_get_by_index():

    phy = _of_phy_get(np, index);
    if (IS_ERR(phy))
            return phy;

    if (!try_module_get(phy->ops->owner))
            return ERR_PTR(-EPROBE_DEFER);

Inside _of_phy_get(), a module reference is temporarily acquired to call the
of_xlate() callback, but it is explicitly dropped via
module_put(phy_provider->owner) before returning the phy pointer.

Additionally, common of_xlate() implementations like of_phy_simple_xlate()
temporarily acquire a device reference but drop it via put_device() before
returning.

Could a concurrent sysfs unbind or module unload of the PHY driver free the
phy structure during the window between _of_phy_get() returning and
of_phy_get_by_index() evaluating phy->ops->owner?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831025506.95548-1-inochiama@gmail.com?part=2

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy