Re: [PATCH net-next v15 06/13] net: mdio: realtek-rtl9300: suppress sysfs bind/unbind attributes

[Andrew Lunn <andrew@lunn.ch>]

On Mon, Aug 31, 2026 at 04:34:32PM +0200, Markus Stockhausen wrote:
> The Realtek MDIO driver relies on devm managed resources for lifetime
> management and allocates its internal central controller structure
> otto_emdio_priv via devm_kzalloc(). This can lead to a use-after-free
> in the following sitauation:
> 
> - If the driver is removed or unbound via sysfs the controller devm
>   cleanup is triggered immediately. A corrupt devicetree might produce
>   a load failure and a cleanup too.
> - However the MDIO buses are allocated with devm_mdiobus_alloc_size()
>   and are reference counted. So if a MAC driver still holds a reference
>   to a PHY device on the bus, the mii_bus will remain alive.
> - Any action that is run for the buses afterwards still relies on the
>   availability of the central priv structure. This will access already
>   freed memory.
> 
> There are multiple mitigations to choose from
> 
> - Clone all controller->priv data into the bus->priv structure.
> - disable sysfs bind/unbind attributes
> - Check for "bus->state != MDIOBUS_REGISTERED" in all callbacks
> 
> This SoC-integrated MDIO controller cannot be physically hot-plugged
> and manual unbinding gives no benefit. The driver is usually
> integrated into the kernel and not loaded as a module. Avoid a
> complex driver rewrite (data duplication) for now and set
> suppress_bind_attrs to true to prevent unbinding via sysfs. This
> mitigates issues for the known use cases.
> 
> Fixes: 24e31e4747698 ("net: mdio: Add RTL9300 MDIO driver")
> Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew