[PATCH RFC v3] net: phy: fix suspicious RCU usage in phy_detach()

[PATCH RFC v3] net: phy: fix suspicious RCU usage in phy_detach()

[syzbot]

During device probe (for example, in ax88772_bind()), drivers may invoke
phylink_connect_phy() before the net_device is registered (while
dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
If connecting or bringing up the PHY fails inside phylink_connect_phy(),
the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
usage warning:

WARNING: suspicious RCU usage
drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
usage!

Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
 phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
 phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
 ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
 ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
 usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
 </TASK>

Fix this by using rcu_dereference_protected() in phy_detach() with a
condition checking whether the RTNL lock is held or dev->reg_state !=
NETREG_REGISTERED. This allows safe cleanup on probe failure before device
registration without requiring drivers to acquire the RTNL lock.

Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
Assisted-by: Gemini:gemini-3.7-flash syzbot
Reported-by: syzbot+694b49f41098a5df4fd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7
Link: https://syzkaller.appspot.com/ai_job?id=63daf6f3-5d22-4261-b346-dfd3a5537965
To: "Andrew Lunn" <andrew@lunn.ch>
To: "David S. Miller" <davem@davemloft.net>
To: "Eric Dumazet" <edumazet@google.com>
To: "Heiner Kallweit" <hkallweit1@gmail.com>
To: "Jakub Kicinski" <kuba@kernel.org>
To: <netdev@vger.kernel.org>
To: "Paolo Abeni" <pabeni@redhat.com>
To: "Kory Maincent" <kory.maincent@bootlin.com>
Cc: <linux-kernel@vger.kernel.org>
Cc: "Russell King" <linux@armlinux.org.uk>

---
v3:
- Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().

v2:
- Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
- Updated the commit subject and description to reflect the changes in phylib.
https://lore.kernel.org/all/5a7201b1-c826-4855-9105-3caa58977bc3@mail.kernel.org/T/

v1:
https://lore.kernel.org/all/2835933a-117e-405a-a369-86459e8c8299@mail.kernel.org/T/
---
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 94b2e85e0..ac09943e1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
 		struct hwtstamp_provider *hwprov;
 
 		/* hwprov may technically be protected by ops lock but
-		 * not for devices with a phydev, see phy_link_topo_add_phy()
+		 * not for devices with a phydev, see phy_link_topo_add_phy().
+		 * RTNL is not held when cleaning up on probe failure before
+		 * device registration.
 		 */
-		hwprov = rtnl_dereference(dev->hwprov);
+		hwprov = rcu_dereference_protected(dev->hwprov,
+						   lockdep_rtnl_is_held() ||
+						   dev->reg_state != NETREG_REGISTERED);
 		/* Disable timestamp if it is the one selected */
 		if (hwprov && hwprov->phydev == phydev) {
 			rcu_assign_pointer(dev->hwprov, NULL);


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH RFC v3] net: phy: fix suspicious RCU usage in phy_detach()

[Aleksandr Nogikh]

On Tue, Sep 8, 2026 at 2:38 PM syzbot <syzbot@kernel.org> wrote:
>
> During device probe (for example, in ax88772_bind()), drivers may invoke
> phylink_connect_phy() before the net_device is registered (while
> dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
> If connecting or bringing up the PHY fails inside phylink_connect_phy(),
> the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
> is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
> held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
> usage warning:

Update the description to be more understandable

>
> WARNING: suspicious RCU usage
> drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
> usage!
>
> Call Trace:
>  <TASK>
>  dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
>  lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
>  phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
>  phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
>  ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
>  ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
>  usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
>  </TASK>
>
> Fix this by using rcu_dereference_protected() in phy_detach() with a
> condition checking whether the RTNL lock is held or dev->reg_state !=
> NETREG_REGISTERED. This allows safe cleanup on probe failure before device
> registration without requiring drivers to acquire the RTNL lock.
>
> Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
> Assisted-by: Gemini:gemini-3.7-flash syzbot
> Reported-by: syzbot+694b49f41098a5df4fd7@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7
> Link: https://syzkaller.appspot.com/ai_job?id=63daf6f3-5d22-4261-b346-dfd3a5537965
> To: "Andrew Lunn" <andrew@lunn.ch>
> To: "David S. Miller" <davem@davemloft.net>
> To: "Eric Dumazet" <edumazet@google.com>
> To: "Heiner Kallweit" <hkallweit1@gmail.com>
> To: "Jakub Kicinski" <kuba@kernel.org>
> To: <netdev@vger.kernel.org>
> To: "Paolo Abeni" <pabeni@redhat.com>
> To: "Kory Maincent" <kory.maincent@bootlin.com>
> Cc: <linux-kernel@vger.kernel.org>
> Cc: "Russell King" <linux@armlinux.org.uk>
>
> ---
> v3:
> - Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().
>
> v2:
> - Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
> - Updated the commit subject and description to reflect the changes in phylib.
> https://lore.kernel.org/all/5a7201b1-c826-4855-9105-3caa58977bc3@mail.kernel.org/T/
>
> v1:
> https://lore.kernel.org/all/2835933a-117e-405a-a369-86459e8c8299@mail.kernel.org/T/
> ---
> diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
> index 94b2e85e0..ac09943e1 100644
> --- a/drivers/net/phy/phy_device.c
> +++ b/drivers/net/phy/phy_device.c
> @@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
>                 struct hwtstamp_provider *hwprov;
>
>                 /* hwprov may technically be protected by ops lock but
> -                * not for devices with a phydev, see phy_link_topo_add_phy()
> +                * not for devices with a phydev, see phy_link_topo_add_phy().
> +                * RTNL is not held when cleaning up on probe failure before
> +                * device registration.
>                  */
> -               hwprov = rtnl_dereference(dev->hwprov);
> +               hwprov = rcu_dereference_protected(dev->hwprov,
> +                                                  lockdep_rtnl_is_held() ||
> +                                                  dev->reg_state != NETREG_REGISTERED);
>                 /* Disable timestamp if it is the one selected */
>                 if (hwprov && hwprov->phydev == phydev) {
>                         rcu_assign_pointer(dev->hwprov, NULL);
>
>
> base-commit: df2908090cda368b01ff43709f51890076c56157
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at syzkaller@googlegroups.com.