From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 38FA8C531F4 for ; Thu, 19 Feb 2026 23:57:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-ID:Subject:Cc:To: From:Date:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=Vzjkl6+3Yw/2iowjOvAgzQ8ljaI/8vdHN6KML9QCt3o=; b=3ugncf9bkwayU9 8c+yWZonmGJuarLSq7zP9Da8Rlh9GCZDRr0xTjqjrShfTnFw1zoH3hPgueCflGceZmOVuIXgiSYtQ XuUBE+iiJfHYKMr95ajTJurUUo1oI1XDQY+TknDxKjLp97GHZyZ80A3KJOIsvywG9VkrTJg73Jy/7 T6O9YcViF85wQieL2NfOnkYg4FKNg1mdpYDd4LRH7EnO3aQnyH5aFsvFLA3o7WacghV9geiLdunYF igSbzMUj8yVp/gczn34Einwl+yBZpkWKDSRx1ibPRZ2OgamJb24s3bsd3CFZEBeAZck6TyRkwaPv4 weDbMFMZOFhlrwLkrMGQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1vtDtW-0000000CgDA-3zj1; Thu, 19 Feb 2026 23:57:18 +0000 Received: from mail-dy1-x1331.google.com ([2607:f8b0:4864:20::1331]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1vtDtU-0000000CgCl-2jk9 for linux-phy@lists.infradead.org; Thu, 19 Feb 2026 23:57:17 +0000 Received: by mail-dy1-x1331.google.com with SMTP id 5a478bee46e88-2baab3137bcso1380103eec.0 for ; Thu, 19 Feb 2026 15:57:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771545435; x=1772150235; darn=lists.infradead.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=L/tn3rlV+s5Ib8pBAw6WX/SwGwQbUEk8OO3BWVinzBQ=; b=OBwREBi/YQXvNWHA0pd4V++JdMZZ8qdfALd1Z0oQWnnow5mMUrYXiLs/U33XMH2u7N AHec//W+sUj/MwNUNPlNtUvMap/c1xmC8sn8N85UuB7T++uiygHCIORR+/vP0SuRptv0 QxYqKc++UNTAw/QHs/pTp282+kE9S8QW4DeXV2WzqDG5fRDs+uouXyzmk4dPUA6n3vbE jaF3fZdO4S+ZzpsCqdXX9MWjUIAMo+u1FteYEBeg/QlF0NXYgxy5VxfB3PYQPwfKLDfw 5wSKucMIZB0s2Zdm2CpiKt5CzkU1ObPz78uOPIGZnZBLWX2CTeaviJAo9LxBHYZblafL lz5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771545435; x=1772150235; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=L/tn3rlV+s5Ib8pBAw6WX/SwGwQbUEk8OO3BWVinzBQ=; b=aMR68oOIwANq3T2X3Ks/R+NCDCNlS9FWXVr2pWF6XlMK8Mf9vdwAJCMui9kydKdQED h4TDGmMD/dRH7r1J7YZnPXNHlk5Lg9idAQN9WD9VBxBnzRQkRffj1AZSsNCb4wN5fZ0s ziFesZEu6HY2jSNToNRrN7igUbpqKWTgMR6Udatisz7vjDq9fK4kSwGpO5cqfaRrPH4w hlC6ImDUA3I3WyRrxeIK0kzv6h8WGgPokG7/1L4KzaAaBi1TFyAG+B9ZRkhogilGmDrJ aucTsLzQIPfl2j20nDl5LIJge6jQGKqis82GPf2xuGhVWZ72y2jmZqjR9kSnZW4HsqCY pF4g== X-Forwarded-Encrypted: i=1; AJvYcCWTP6CfzDRYSeHAqmjmRSI8ATQ6CWxfXOLMyQ8/yuxHeGuRzhYv1cHza1wsPXpGNeny7VM/GfFlPFo=@lists.infradead.org X-Gm-Message-State: AOJu0YwFyZ/h/PCLHNtS8WBc5XgLTuZGEil/5Z/OkqpVkL8kbODFVW96 35jwa0gtrvq2bDoE5tXAdJlU896aVw8qafAXN/0Hcf3HbQN1JDkT/UC+ X-Gm-Gg: AZuq6aJoh6WVNsYXpRjRFwAXck8MAmlkAQbACIlJ3+LK7HrAJkEmNrcrxmdEIYSDMgj jW9I8MtX7tAvd4GEABnDTcpvSyyWJYkx6HFG6UUh6bKjiksamn7J3TU5TrIEnZvK3GZ3+as3V7Q FiZzEHlXnLg+UK6fGlttJFbqf/vOITHglkGZuztrGd+spyeoGJ/ccHrYLrZ9TkpmlKFboPoLwEd UHxo7hhcXwoJnD9/MTSmKzcOkWMDQEjU5uVF/I3Cx36L8R+b6dk62SjToQLL8MCg0BqL2owbbOz 0xHkTHTWwuynnH5Yb02fkB6tPybkJoQKB6RElpUhmf4EiiIHUb4ESdvAgmbR7+34Bhe3iQFUE16 5b1pAPLSl+asioHdzaChn9fA9+peSfpeb2pD9YiyFHWOKXgq5DE59nf0bpizzAiN2phOQkhhuQc UNDsu6ZfG0k4VNozRMRX9n9yilwSLg5XY8l3wHKuc1lRd2BxUxTjWI7efCLJXTDTR6 X-Received: by 2002:a05:7301:3f07:b0:2b7:19f2:6b70 with SMTP id 5a478bee46e88-2bac97ab3b9mr7434358eec.26.1771545435151; Thu, 19 Feb 2026 15:57:15 -0800 (PST) Received: from google.com ([2a00:79e0:2ebe:8:9c24:8181:603e:7ad7]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2bacb543e1dsm22099845eec.4.2026.02.19.15.57.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Feb 2026 15:57:14 -0800 (PST) Date: Thu, 19 Feb 2026 15:57:11 -0800 From: Dmitry Torokhov To: Vinod Koul Cc: Neil Armstrong , "Rafael J. Wysocki" , Geert Uytterhoeven , Johan Hovold , Claudiu Beznea , "Dr. David Alan Gilbert" , Peter Griffin , Dmitry Baryshkov , Krzysztof Kozlowski , Zijun Hu , linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] phy: core: fix potential UAF in of_phy_simple_xlate() Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260219_155716_701051_66111156 X-CRM114-Status: GOOD ( 11.25 ) X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org The implementation put_device()s located device and then uses container_of() on the pointer. The device may disappear by that time, resulting in UAF. Fix the problem by keeping the reference to the framer device, avoiding getting an extra reference to it in framer_get(), and making sure to drop the reference in error path when we fail to get the module. Fixes: e6625db66212 ("phy: core: Simplify API of_phy_simple_xlate() implementation") Signed-off-by: Dmitry Torokhov --- drivers/phy/phy-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c index 4ad396214d0c..cf62eb9ddca9 100644 --- a/drivers/phy/phy-core.c +++ b/drivers/phy/phy-core.c @@ -682,10 +682,10 @@ struct phy *of_phy_get(struct device_node *np, const char *con_id) if (IS_ERR(phy)) return phy; - if (!try_module_get(phy->ops->owner)) + if (!try_module_get(phy->ops->owner)) { + put_device(&phy->dev); return ERR_PTR(-EPROBE_DEFER); - - get_device(&phy->dev); + } return phy; } @@ -765,7 +765,6 @@ struct phy *of_phy_simple_xlate(struct device *dev, if (!target_dev) return ERR_PTR(-ENODEV); - put_device(target_dev); return to_phy(target_dev); } EXPORT_SYMBOL_GPL(of_phy_simple_xlate); -- 2.53.0.345.g96ddfc5eaa-goog -- Dmitry -- linux-phy mailing list linux-phy@lists.infradead.org https://lists.infradead.org/mailman/listinfo/linux-phy From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f171.google.com (mail-dy1-f171.google.com [74.125.82.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 308F82D8376 for ; Thu, 19 Feb 2026 23:57:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771545437; cv=none; b=SucYNq44/A7QYJTOaCqzFYWdg5zJs1D+dxmOOQ+5XvRreiOCqqDqSs6k5rOWEb6t1xF9iNk9DYDzNJZZk0ZRaGr+tIsZxoChYb09NppHk+Ab9TL4dz+QZKHx1iMDlz6xwCSORmLH1soF+EKldvVevqijfI3FjWCPKSholBWt6o0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771545437; c=relaxed/simple; bh=sj2tJYCyT+rHyjWzt7ciuMOJEoBsJ6ghU0FECAPFjiw=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=s0tPpd+XUOvQCB4w5wSFGqlvrs1hWyln9BPD/ZNEserTCzANloNXBAWeBeKcrcUu9MDIkK39wM5dB/MdWqI5lHCu8nCmtSVMnpMpMx0vPWCV9PLNX8VCylU2FbKvQ+QNBcavcx77UfSDVOrByGZEM694IQJJdYjazuCNjeeSmfI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=FT0mqq1A; arc=none smtp.client-ip=74.125.82.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="FT0mqq1A" Received: by mail-dy1-f171.google.com with SMTP id 5a478bee46e88-2baab3137bcso1380106eec.0 for ; Thu, 19 Feb 2026 15:57:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771545435; x=1772150235; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=L/tn3rlV+s5Ib8pBAw6WX/SwGwQbUEk8OO3BWVinzBQ=; b=FT0mqq1Aw2KR2Jvr2Rf6psMJnwDWGwGI0g+IGUSXZkbdpHElrsx0cXpC8/7MMJIB/w QXiNVOC+4zu6+m8rVV08LSNqUMbkZ4Nhpjj2d5qlBl0OHIf+HdkeizbgNDEi3QYvXiDs KgTILNjtUVSQSMJ4cJVZVPSBAZArKb05Qp3akLY/ltBVGx3VbMBBvh0PC227Gx43QHUo x+1ixv7cKy1ggdd8g1+J954cWikqywRbtoL91p+8iUacTe7YsjoeaeDfdVxgRNyf2FyE PKy/hzC1yPW7F153kxxHJj2BXUS4lVb3VC+Hs+PDWMktUke1+0ax4yYVatsxDMPv7XBb SnsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771545435; x=1772150235; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=L/tn3rlV+s5Ib8pBAw6WX/SwGwQbUEk8OO3BWVinzBQ=; b=rHiNFBmR6Om04Pa+PB9bCWfplPek3wK6ynQppD6bZLFPCyHXh3gnpr0sQ6AwBJ0LTG cYZ+Mkw6nNH/OmIfienWmsMxCT4z3fAtwEsUruFeGA+zZ71IcVCHd2wg5wqvKfHNnAEn BIqSFVcoVMt7W05NgxSmMm5iK3LiWJnF7HjjcaA42LMzndkREJkCUP7blpGokTw4Vxwf ZuvAUyKIVQQqxvU4ByI+cvPeTDb3M6VKkCzrcVU8Zsl9lu62U4MI8VkaRs3HWGWQmE0F 9pIu+R6HOY9/WLUpffu+OTWVdLMOfAjRv0eLuAkeSh+gs8g+PS3oGqHoXgvFcFVcD7wc sjYg== X-Forwarded-Encrypted: i=1; AJvYcCUhnnktpAAQcD+r5GgwX/dOLFovMcMiHrsVmB8W7jolF+BXs3+8ETexSqgmdPgYUrNBcsUXual5k+Wnibo=@vger.kernel.org X-Gm-Message-State: AOJu0YwHQ4OzaXxIC3BWl5t2d1cxHazW9+tRqMBFycywCD4y5f+jrjWD VmDnwr9wD+X59mh99EUqv1+GTn4i/FxJh0BE6i9jomDn2O7UV62rLhul X-Gm-Gg: AZuq6aJa7Z83JCiTPe21Z9tPS5lYoXbZTYthr1th7kYvh5Hw0psdpgrp7oQi0iSvIPX e0GgP8CllkxHUIxWJEbLrir8Y6v3MK6K5hpHI2H94uvZ4oO9SuAgRz6J55mfLzNQjwB0ARZ1kQ0 ugtNgT21HrZrPavyqsqsWJBSo8ssAk0aF4v8Gi//NG32BJnLxhAI0VFtzo8UmpXE3S5x5zpp5Wt TyIGulQEm7qxodkJf5HFth5mQeXg3L83ADseLvuEjiWjImibOTi917mcVw5TpLkZMF+PN+oQvda vSNGSfssoV7wPLWHyVy1LOBO8Ne70E/X8sbu9SyGAEugTE9kLmQBeyJHzf9bMJnjpdsIn6DbxNG rQWNzWIYxzOVVkA80mXP6XITAvfbwOZSzNcZfZ0qAPBUV1cQCgq4GMW2asPIazpx6EMZiPeLDY8 nYMj6j826GH6yXuNKyKEgJ0n3nK0lTTnmjT/z30Sjd3HXMRol0/fmsFYiePTriwUsH X-Received: by 2002:a05:7301:3f07:b0:2b7:19f2:6b70 with SMTP id 5a478bee46e88-2bac97ab3b9mr7434358eec.26.1771545435151; Thu, 19 Feb 2026 15:57:15 -0800 (PST) Received: from google.com ([2a00:79e0:2ebe:8:9c24:8181:603e:7ad7]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-2bacb543e1dsm22099845eec.4.2026.02.19.15.57.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Feb 2026 15:57:14 -0800 (PST) Date: Thu, 19 Feb 2026 15:57:11 -0800 From: Dmitry Torokhov To: Vinod Koul Cc: Neil Armstrong , "Rafael J. Wysocki" , Geert Uytterhoeven , Johan Hovold , Claudiu Beznea , "Dr. David Alan Gilbert" , Peter Griffin , Dmitry Baryshkov , Krzysztof Kozlowski , Zijun Hu , linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] phy: core: fix potential UAF in of_phy_simple_xlate() Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline The implementation put_device()s located device and then uses container_of() on the pointer. The device may disappear by that time, resulting in UAF. Fix the problem by keeping the reference to the framer device, avoiding getting an extra reference to it in framer_get(), and making sure to drop the reference in error path when we fail to get the module. Fixes: e6625db66212 ("phy: core: Simplify API of_phy_simple_xlate() implementation") Signed-off-by: Dmitry Torokhov --- drivers/phy/phy-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c index 4ad396214d0c..cf62eb9ddca9 100644 --- a/drivers/phy/phy-core.c +++ b/drivers/phy/phy-core.c @@ -682,10 +682,10 @@ struct phy *of_phy_get(struct device_node *np, const char *con_id) if (IS_ERR(phy)) return phy; - if (!try_module_get(phy->ops->owner)) + if (!try_module_get(phy->ops->owner)) { + put_device(&phy->dev); return ERR_PTR(-EPROBE_DEFER); - - get_device(&phy->dev); + } return phy; } @@ -765,7 +765,6 @@ struct phy *of_phy_simple_xlate(struct device *dev, if (!target_dev) return ERR_PTR(-ENODEV); - put_device(target_dev); return to_phy(target_dev); } EXPORT_SYMBOL_GPL(of_phy_simple_xlate); -- 2.53.0.345.g96ddfc5eaa-goog -- Dmitry