Re: [PATCH net-next v15 06/13] net: mdio: realtek-rtl9300: suppress sysfs bind/unbind attributes

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incomplete Fix / Use-After-Free due to devm lifetime mismatch
--

commit d4a21a88756b9fbf7a5e82fcf73b2397de6c2abb
Author: Markus Stockhausen <markus.stockhausen@gmx.de>
Subject: net: mdio: realtek-rtl9300: suppress sysfs bind/unbind attributes

This commit mitigates a use-after-free issue in the Realtek MDIO driver by
setting suppress_bind_attrs to prevent unbinding via sysfs, which avoids
triggering the devm cleanup while bus references are still held.

> diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
> index 69565a87f99db..7de8adec243ba 100644
> --- a/drivers/net/mdio/mdio-realtek-rtl9300.c
> +++ b/drivers/net/mdio/mdio-realtek-rtl9300.c
> @@ -844,6 +844,7 @@ static struct platform_driver otto_emdio_driver = {
>  	.driver = {
>  		.name = "mdio-rtl9300",
>  		.of_match_table = otto_emdio_ids,
> +		.suppress_bind_attrs = true,

[Severity: High]
This is a pre-existing issue, but this mitigation appears incomplete. It
prevents unbinding via sysfs, but does it cover the probe failure vector?

In otto_emdio_probe(), the priv structure is allocated via devm_kzalloc(). 
Then, it iterates over child nodes:

    device_for_each_child_node_scoped(dev, child) {
        err = otto_emdio_probe_one(dev, priv, child);
        if (err)
            return err;
    }

If probing fails on a subsequent child node, the parent probe returns an error.
This triggers devres cleanup which frees the priv structure.

However, if an earlier bus was successfully registered, a MAC driver might have
already attached to a PHY on that bus, holding a reference to the mii_bus. 

When that MAC driver subsequently performs a read, it calls 
otto_emdio_read_c22():

    scoped_guard(mutex, &priv->lock)
        ret = priv->info->read_c22(bus, port, regnum, &value);

Because priv was already freed by devres, does this result in a 
use-after-free? 

Could a malformed device tree triggering a failure on a secondary MDIO bus 
still cause memory corruption due to this lifetime mismatch, despite the
sysfs unbind mitigation?

>  	},
>  };
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831143439.2404484-1-markus.stockhausen@gmx.de?part=6