Re: [PATCH net-next v11 04/12] net: phylink: save phylink instance fwnode on phylink_create

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch saves a pointer to a reference-counted `fwnode_handle` in `struct phylink` without acquiring a reference, creating a dormant use-after-free vulnerability.
--

--- Patch [4]: [PATCH net-next v11 04/12] net: phylink: save phylink instance fwnode on phylink_create ---
commit 45a3120238ef47d0743c1bd3fbcd3cc41505b72f
Author: Christian Marangi <ansuelsmth@gmail.com>

net: phylink: save phylink instance fwnode on phylink_create

This commit adds a new fwnode field to the internal struct phylink and
stores the passed fwnode_handle pointer during phylink_create(). This
allows future functions to reference the firmware node after creation,
as it might differ from the device firmware node.

> diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
> index 9decd7333c702..041405ce6bf05 100644
> --- a/drivers/net/phy/phylink.c
> +++ b/drivers/net/phy/phylink.c
> @@ -44,6 +44,7 @@ struct phylink {
>  	const struct phylink_mac_ops *mac_ops;
>  	struct phylink_config *config;
>  	struct phylink_pcs *pcs;
> +	const struct fwnode_handle *fwnode;
>  	struct device *dev;
>  	unsigned int old_link_state:1;
>  
> @@ -1988,6 +1989,7 @@ struct phylink *phylink_create(struct phylink_config *config,
>  	INIT_LIST_HEAD(&pl->pcs_list);
>  
>  	pl->config = config;
> +	pl->fwnode = fwnode;

[Severity: Medium]
Will this lead to a use-after-free when callers drop their fwnode reference?

If a caller retrieves the fwnode via iterators like
fwnode_for_each_available_child_node(), the iterator drops the reference to
the node when the loop proceeds. Because phylink_create() assigns the
pointer without taking its own reference via fwnode_handle_get(), the
stored pointer could become dangling immediately after the caller's loop
iteration finishes.

Should this use fwnode_handle_get(fwnode) to ensure the node remains valid for
the future code paths mentioned in the commit message?

>  	if (config->type == PHYLINK_NETDEV) {
>  		pl->netdev = to_net_dev(config->dev);
>  		netif_carrier_off(pl->netdev);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807131301.192060-1-ansuelsmth@gmail.com?part=4