Re: [PATCH 1/3] phy: core: Add common helper to add phy phandle device link

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The `of_phy_simple_xlate` function drops the device reference before returning it, leading to a Use-After-Free if the PHY device is concurrently unregistered.
--

commit cd21d0b3786ada14d9e18e94ffc3887f9ea8b747
Author: Inochi Amaoto <inochiama@gmail.com>

phy: core: Add common helper to add phy phandle device link
    
It is very common for adding a device link for phy phandle
for device managed phy helper functions. So add a common
helper for future reuse.

> diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
> index 21aaf2f76e53e..451f8f0644c13 100644
> --- a/drivers/phy/phy-core.c
> +++ b/drivers/phy/phy-core.c

[ ... ]

> @@ -784,7 +804,6 @@ struct phy *phy_get(struct device *dev, const char *string)
>  {
>  	int index = 0;
>  	struct phy *phy;
> -	struct device_link *link;

[Severity: High]
This isn't a bug introduced by this patch, but could this code cause memory
corruption?

drivers/phy/phy-core.c:of_phy_simple_xlate() {
	...
	target_dev = class_find_device_by_of_node(&phy_class, args->np);
	if (!target_dev)
		return ERR_PTR(-ENODEV);

	put_device(target_dev);
	return to_phy(target_dev);
}

The of_phy_simple_xlate() function locates the PHY device using
class_find_device_by_of_node(), which returns it with an incremented
reference count. However, it immediately calls put_device() to drop the
reference before returning the pointer. 

If a concurrent thread unregisters the PHY device (e.g., via module
removal or driver unbind), this put_device() might drop the final
reference, freeing the memory. The caller could then access the freed
pointer. Could this lead to a use-after-free race condition?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831025506.95548-1-inochiama@gmail.com?part=1

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy