[PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[YuanZhe Liu]

lan78xx_disconnect() unconditionally calls phylink_stop(), but
phylink_start() is only called from lan78xx_open(). When the device is
unplugged before the interface has been brought up, the attached PHY is
still in PHY_READY and phy_stop() reports:

  called from state READY
  WARNING: drivers/net/phy/phy.c:1670 at phy_stop+0xad/0x380

The same warning is emitted after an ifup/ifdown cycle, where the PHY is
already in PHY_HALTED. Call phylink_stop() only when the network device is
running, which is when phylink_start() has been called.

Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")
Cc: stable@vger.kernel.org
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>
---
 drivers/net/usb/lan78xx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 5655941f1478..68e61004b3d7 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -4581,7 +4581,8 @@ static void lan78xx_disconnect(struct usb_interface *intf)
 	net = dev->net;
 
 	rtnl_lock();
-	phylink_stop(dev->phylink);
+	if (netif_running(net))
+		phylink_stop(dev->phylink);
 	phylink_disconnect_phy(dev->phylink);
 	rtnl_unlock();
 
-- 
2.34.1

Re: [PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] net: usb: lan78xx: premature phylink teardown in lan78xx_disconnect()
--

commit eb1582b80d2c934b47efc3b66502d9e9f347ba7e
Author: YuanZhe Liu <25031212351@stu.xidian.edu.cn>

net: usb: lan78xx: only stop phylink if the interface is running

This commit updates lan78xx_disconnect() to only call phylink_stop() when
netif_running() is true, avoiding a warning in phy_stop() when a USB device is
unplugged while the network interface is down.

> diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
> index 181e8c087655c..6dc622a6ae783 100644
> --- a/drivers/net/usb/lan78xx.c
> +++ b/drivers/net/usb/lan78xx.c
> @@ -4594,7 +4594,8 @@ static void lan78xx_disconnect(struct usb_interface *intf)
>  	net = dev->net;
>  
>  	rtnl_lock();
> -	phylink_stop(dev->phylink);
> +	if (netif_running(net))
> +		phylink_stop(dev->phylink);
>  	phylink_disconnect_phy(dev->phylink);
>  	rtnl_unlock();

[Severity: Medium]
Does calling phylink_stop() and phylink_disconnect_phy() before
unregister_netdev(net) in drivers/net/usb/lan78xx.c:lan78xx_disconnect() cause
out-of-order teardown, a duplicate phylink_stop() call, and a race window when
rtnl_lock() is dropped?

In drivers/net/usb/lan78xx.c:lan78xx_disconnect():

	rtnl_lock();
	if (netif_running(net))
		phylink_stop(dev->phylink);
	phylink_disconnect_phy(dev->phylink);
	rtnl_unlock();

	unregister_netdev(net);

When netif_running(net) is true, calling phylink_stop(dev->phylink) here runs
lan78xx_mac_link_down() without holding dev->dev_mutex and while dev->napi,
TX/RX URBs, and dev->urb_intr are still active.

Because phylink_stop() does not clear __LINK_STATE_START, the subsequent
unregister_netdev(net) call sees that the interface is still running and
invokes ndo_stop -> lan78xx_stop():

drivers/net/usb/lan78xx.c:lan78xx_stop() {
	...
	mutex_lock(&dev->dev_mutex);
	...
	clear_bit(EVENT_DEV_OPEN, &dev->flags);
	napi_disable(&dev->napi);

	lan78xx_terminate_urbs(dev);
	...
	phylink_stop(dev->phylink);

	usb_kill_urb(dev->urb_intr);
	...
}

This executes phylink_stop(dev->phylink) a second time after
phylink_disconnect_phy(dev->phylink) has already detached the PHY.

In addition, releasing rtnl_unlock() before unregister_netdev(net) leaves net
registered while dev->phylink has already disconnected its PHY and freed the
PHY IRQ. In that window, a concurrent dev_open() -> lan78xx_open() can call
phylink_start(dev->phylink) on the disconnected phylink instance:

drivers/net/usb/lan78xx.c:lan78xx_open() {
	...
	phylink_start(dev->phylink);
	...
}

Similarly, dev->urb_intr remains active until lan78xx_stop() or later in
lan78xx_disconnect(), so an interrupt URB completion can still invoke
generic_handle_irq_safe(dev->domain_data.phyirq) after phy_disconnect() has
freed the IRQ.

Should lan78xx_disconnect() instead call unregister_netdev(net) first (which
automatically invokes lan78xx_stop() -> phylink_stop(dev->phylink) under
rtnl_lock() and dev->dev_mutex when the interface is running), and then call
phylink_disconnect_phy(dev->phylink) under rtnl_lock() afterwards?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261029160204.2567-1-25031212351@stu.xidian.edu.cn?part=1

Re: [PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[YuanZhe Liu]

Hi Andrew,

Could you please review this patch?

  [PATCH net] net: usb: lan78xx: only stop phylink if the interface is
  running

It calls phylink_stop() during lan78xx disconnect only when the network
interface is running.

The patch is unchanged. I am copying this address for visibility.

Original submission:
https://lore.kernel.org/r/20261029160204.2567-1-25031212351@stu.xidian.edu.cn

Thanks,
YuanZhe

Re: [PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[Andrew Lunn]

On Sat, Oct 31, 2026 at 01:38:41AM +0800, YuanZhe Liu wrote:
> Hi Andrew,
> 
> Could you please review this patch?

You should respond to what the sashiko-bot@kernel.org has said.

    Andrew

Re: [PATCH net] net: usb: lan78xx: only stop phylink if the interface is running

[Andrew Lunn]

On Fri, Oct 30, 2026 at 12:02:04AM +0800, YuanZhe Liu wrote:
> lan78xx_disconnect() unconditionally calls phylink_stop(), but
> phylink_start() is only called from lan78xx_open(). When the device is
> unplugged before the interface has been brought up, the attached PHY is
> still in PHY_READY and phy_stop() reports:
> 
>   called from state READY
>   WARNING: drivers/net/phy/phy.c:1670 at phy_stop+0xad/0x380
> 
> The same warning is emitted after an ifup/ifdown cycle, where the PHY is
> already in PHY_HALTED. Call phylink_stop() only when the network device is
> running, which is when phylink_start() has been called.
> 
> Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management")

Why did you pick this commit?

    Andrew