Re: [PATCH net-next v2 03/10] net: ethernet: oa_tc6: add OA_TC6_BROKEN_PHY quirk flag

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] A use-after-free can occur in `oa_tc6_exit` due to calling `kthread_stop` on a potentially exited SPI thread.
--

commit 2df5842f4d484126d9bd25fecac7f531ed8e5916
Author: Ciprian Regus <ciprian.regus@analog.com>

net: ethernet: oa_tc6: add OA_TC6_BROKEN_PHY quirk flag

This commit adds the OA_TC6_BROKEN_PHY quirk flag, allowing drivers to manage
the PHY manually by skipping oa_tc6's internal PHY initialization. It also
converts oa_tc6_init() to take a configuration structure to avoid extending
the function signature in the future.

> diff --git a/drivers/net/ethernet/oa_tc6.c b/drivers/net/ethernet/oa_tc6.c
> index baba5aad84dfa..7ae3639beaddd 100644
> --- a/drivers/net/ethernet/oa_tc6.c
> +++ b/drivers/net/ethernet/oa_tc6.c
[ ... ]
> @@ -1277,24 +1284,28 @@ static int oa_tc6_check_ctrl_protection(struct oa_tc6 *tc6)
>  
>  /**
>   * oa_tc6_init - allocates and initializes oa_tc6 structure.
> - * @spi: device with which data will be exchanged.
> - * @netdev: network device interface structure.
> + * @config: pointer to a caller-filled structure describing the MACPHY
> + *          (SPI device, net_device, and config flags).
>   *
>   * Return: pointer reference to the oa_tc6 structure if the MAC-PHY
>   * initialization is successful otherwise NULL.
>   */
> -struct oa_tc6 *oa_tc6_init(struct spi_device *spi, struct net_device *netdev)
> +struct oa_tc6 *oa_tc6_init(struct oa_tc6_config *config)
>  {

[Severity: High]
This is a pre-existing issue, but can calling kthread_stop() in oa_tc6_exit()
lead to a use-after-free?

In oa_tc6_spi_thread_handler(), if oa_tc6_try_spi_transfer() returns an
error, the kthread function returns. This causes the kthread to exit and its
task_struct to be automatically freed.

Later, if the driver is unloaded or an error handling path invokes
oa_tc6_exit(), it unconditionally calls kthread_stop(tc6->spi_thread).

Since kthread_run() does not acquire an extra reference for the caller,
could kthread_stop() dereference the freed task_struct, potentially leading
to a kernel panic?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260527-adin1140-driver-v2-0-37e5c8d4e0a0@analog.com?part=3