From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793831499; b=oAo5T85ZfBOhj9ugWDSBu0BSGvmm4+le1+nzDGZ3g3a1HM14UU6Oo/htB9kB7qYecxd3 1g5uUeJVWZDo7HpNwfDBmwE/LoXvnJLLo0F3yeUElsBi7ZxiRjQipX+fUiyv2zuVZ4jdh dVoJ1hGfMU5vyzbn43PItCtB4NxaYJbrFxROURbsqIwvLfMBQZK7+ZAg2sqkWM5eP5M1c HmoopBB20HnfqwaM+ZNcu2VwYkXqCLcnG5eScgNrB4Gkk8id9909eweIdp2A/UvUPEudf 3Pnl7WlD7+1tTNtWGjGo9mdsgr529k/bUrI09zUVlbRGT3E0TopzPhZ5kxH0y4sEAlQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793831499; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=sA3lSqT1XCcG4ZN7jaPv2DNbkpbkEKDBBfGh1KKWEbo=; b=cEUJrIRwMnJl3yR0p2DwcmamKfoHtedBIX9RggVT+mjqQpKeMG6T/g1sLu1lHlTZc3gT 1RZoc+he/DkAeGpaz4FZc/9Da2aomhOYlhTFmyq0m5n3S6nWyGByRc/TH00w6ZULWAzrn D9ALKbutdiccBv5NaKeTQ3hDEPSbkZjU/feLjl54nKSEc1GmyuPYYnYASw+qZMZRMZz/Y n61c3yeNgh8IFKOLUBrJ9h5IPkgM5sHbAZdfG4XBO0o21WL4PVDYedR2Ivz8TNxJNdy6w z3+Yymgvb0BFxss8iFsNXy0EVTjj4dVTVXgI+V7MKYH9IEiBTyHKNLrQTiYUvfoEkNQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ruBhRoLR; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1B736606E826; Wed, 4 Nov 2026 22:31:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=ruBhRoLR Received: by smtp.kernel.org (Postfix) with ESMTPSA id ABE8B1F000C1; Wed, 4 Nov 2026 22:31:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793831499; bh=sA3lSqT1XCcG4ZN7jaPv2DNbkpbkEKDBBfGh1KKWEbo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ruBhRoLRqe4KJpoNnrJniaW4zOWNOK3qLzNLxqclnQUAWepPMSu7zdlWe1HuO0+rn ffnsPrdV0Iq+oALvWe9/2pNYt2xmdkdaGu/QJqi4ehuhwpGykuUTF9rVJCo6dCWe6f us5UJMlcgghIAzHr7WPG9CmIHHu0Z0TT/ho4MLJ8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Manivannan Sadhasivam , Loic Poulain , Bryan ODonoghue , Vinod Koul , Oleg Keri Subject: [PATCH 6.18 0740/1005] phy: core: Fix race-condition between _of_phy_get() and try_module_get() Date: Wed, 4 Nov 2026 16:07:53 -0500 Message-ID: <20261104211104.204332989@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261104211043.516122098@linuxfoundation.org> References: <20261104211043.516122098@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryan O'Donoghue commit 090055ee629523092688da42428558ba56d4272f upstream. Sashiko asked during a patch review if the existing usage pattern had a race condition; specifically in of_phy_get() if it was possible between returning from _of_phy_get() and running try_module_get() that a module might be unbound leading to use-after-free. Looking at the code this appears to be so, there is no linkage between the phy and module under a synchronisation primitive. Using the phy_provider_mutex in phy_get() will ensure there is a link between the returned phy pointer and the module_get() bumping the module reference count. Amend phy_get(), of_phy_get() and devm_of_phy_get_by_index() to fix the same usage pattern. phy_provider_unregister() must take the phy_provider_mutex so amending phy_get()/of_phy_get() to take that same mutex guarantees there is no use-after-free. Fixes: ff764963479a1 ("drivers: phy: add generic PHY framework") Cc: stable@vger.kernel.org Reviewed-by: Manivannan Sadhasivam Reviewed-by: Loic Poulain Tested-by: Oleg Keri # Lenovo Yoga Slim 7x Gen 11 (Glymur) Signed-off-by: Bryan O'Donoghue Link: https://patch.msgid.link/20260918-b4-linux-next-25-03-13-dtsi-x1e80100-camss-v20-1-dc244e124e71@linaro.org Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/phy/phy-core.c | 45 ++++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) --- a/drivers/phy/phy-core.c +++ b/drivers/phy/phy-core.c @@ -124,13 +124,13 @@ static struct phy *phy_find(struct devic const char *dev_id = dev_name(dev); struct phy_lookup *p, *pl = NULL; - mutex_lock(&phy_provider_mutex); + lockdep_assert_held(&phy_provider_mutex); + list_for_each_entry(p, &phys, node) if (!strcmp(p->dev_id, dev_id) && !strcmp(p->con_id, con_id)) { pl = p; break; } - mutex_unlock(&phy_provider_mutex); return pl ? pl->phy : ERR_PTR(-ENODEV); } @@ -602,6 +602,8 @@ static struct phy *_of_phy_get(struct de struct phy *phy = NULL; struct of_phandle_args args; + lockdep_assert_held(&phy_provider_mutex); + ret = of_parse_phandle_with_args(np, "phys", "#phy-cells", index, &args); if (ret) @@ -613,11 +615,10 @@ static struct phy *_of_phy_get(struct de goto out_put_node; } - mutex_lock(&phy_provider_mutex); phy_provider = of_phy_provider_lookup(args.np); if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) { phy = ERR_PTR(-EPROBE_DEFER); - goto out_unlock; + goto out_put_node; } if (!of_device_is_available(args.np)) { @@ -631,8 +632,6 @@ static struct phy *_of_phy_get(struct de out_put_module: module_put(phy_provider->owner); -out_unlock: - mutex_unlock(&phy_provider_mutex); out_put_node: of_node_put(args.np); @@ -656,15 +655,21 @@ struct phy *of_phy_get(struct device_nod if (con_id) index = of_property_match_string(np, "phy-names", con_id); + mutex_lock(&phy_provider_mutex); + phy = _of_phy_get(np, index); if (IS_ERR(phy)) - return phy; + goto out_unlock; - if (!try_module_get(phy->ops->owner)) - return ERR_PTR(-EPROBE_DEFER); + if (!try_module_get(phy->ops->owner)) { + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; + } get_device(&phy->dev); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(of_phy_get); @@ -764,6 +769,7 @@ struct phy *phy_get(struct device *dev, struct phy *phy; struct device_link *link; + mutex_lock(&phy_provider_mutex); if (dev->of_node) { if (string) index = of_property_match_string(dev->of_node, "phy-names", @@ -774,15 +780,18 @@ struct phy *phy_get(struct device *dev, } else { if (string == NULL) { dev_WARN(dev, "missing string\n"); - return ERR_PTR(-EINVAL); + phy = ERR_PTR(-EINVAL); + goto out_unlock; } phy = phy_find(dev, string); } if (IS_ERR(phy)) - return phy; + goto out_unlock; - if (!try_module_get(phy->ops->owner)) - return ERR_PTR(-EPROBE_DEFER); + if (!try_module_get(phy->ops->owner)) { + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; + } get_device(&phy->dev); @@ -791,6 +800,8 @@ struct phy *phy_get(struct device *dev, dev_dbg(dev, "failed to create device link to %s\n", dev_name(phy->dev.parent)); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(phy_get); @@ -939,15 +950,17 @@ struct phy *devm_of_phy_get_by_index(str if (!ptr) return ERR_PTR(-ENOMEM); + mutex_lock(&phy_provider_mutex); phy = _of_phy_get(np, index); if (IS_ERR(phy)) { devres_free(ptr); - return phy; + goto out_unlock; } if (!try_module_get(phy->ops->owner)) { devres_free(ptr); - return ERR_PTR(-EPROBE_DEFER); + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; } get_device(&phy->dev); @@ -960,6 +973,8 @@ struct phy *devm_of_phy_get_by_index(str dev_dbg(dev, "failed to create device link to %s\n", dev_name(phy->dev.parent)); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);