Re: [PATCH net-next v8 4/9] net: mdio: realtek-rtl9300: extend controller structure lifetime

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Ineffective Fix / Unresolved Use-After-Free
--

--- Patch [4]: [PATCH net-next v8 4/9] net: mdio: realtek-rtl9300: extend controller structure lifetime ---
commit b6df87c0a19bdf7cb3946cca13544583a9dac7fd
Author: Markus Stockhausen <markus.stockhausen@gmx.de>

net: mdio: realtek-rtl9300: extend controller structure lifetime

This commit attempts to use a kref counter for the controller private data
to decouple its lifetime from the platform device and tie it to the MDIO
buses, aiming to prevent a use-after-free during teardown.

> diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
> index 3dee5bff41349..9529f877248ba 100644
> --- a/drivers/net/mdio/mdio-realtek-rtl9300.c
> +++ b/drivers/net/mdio/mdio-realtek-rtl9300.c

[ ... ]

> @@ -617,6 +634,11 @@ static int otto_emdio_probe_one(struct device *dev, struct otto_emdio_priv *priv
>  
>  	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-%d", dev_name(dev), mdio_bus);
>  
> +	kref_get(&priv->kref);
> +	err = devm_add_action_or_reset(dev, otto_emdio_cleanup_bus, priv);
> +	if (err)
> +		return dev_err_probe(dev, err, "cannot register cleanup action\n");
> +

[Severity: High]
This is a pre-existing issue, but does this approach actually decouple the
lifetime from the platform device?

In otto_emdio_probe_one(), registering the cleanup action against the
platform device (dev) via devm_add_action_or_reset() means
devres_release_all() will still execute otto_emdio_cleanup_bus()
synchronously during the platform device unbind phase.

Won't this drop the kref to 0 and free the priv structure at the exact same
time as the old devm_kzalloc() teardown would have, regardless of whether
the mii_bus objects are kept alive by external references?

If the mii_bus objects outlive the platform device unbind, could accessing
bus operations still dereference the freed priv pointer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727191559.19617-1-markus.stockhausen@gmx.de?part=4