[PATCH net-next v11 05/10] net: mdio: realtek-rtl9300: suppress sysfs bind/unbind attributes

[Markus Stockhausen <markus.stockhausen@gmx.de>]

The Realtek MDIO driver relies on devm managed resources for lifetime
management and allocates its internal central controller structure
otto_emdio_priv via devm_kzalloc(). This can lead to a use-after-free
in the following sitauation:

- If the driver is unbound via sysfs the controller devm cleanup is
  triggered immediately.
- However the MDIO buses are allocated with devm_mdiobus_alloc_size()
  and are reference counted. So if a MAC driver still holds a reference
  to a PHY device on the bus, the mii_bus will remain alive.
- Any action that is run for the buses afterwards still relies on the
  availability of the central priv structure. This will access already
  freed memory.

There are multiple possible solutions to mitigate that:

- disable sysfs bind/unbind attributes
- Clone all controller->priv data into the bus->priv structure.
- Check for "bus->state != MDIOBUS_REGISTERED" in all callbacks

Since this SoC-integrated MDIO controller cannot be physically hot-plugged
and manual unbinding introduces potentially dangerous race conditions,
set suppress_bind_attrs to true to prevent unbinding via sysfs.

Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
---
 drivers/net/mdio/mdio-realtek-rtl9300.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c
index 73ac5fdcd267..1873928b362d 100644
--- a/drivers/net/mdio/mdio-realtek-rtl9300.c
+++ b/drivers/net/mdio/mdio-realtek-rtl9300.c
@@ -830,6 +830,7 @@ static struct platform_driver otto_emdio_driver = {
 	.driver = {
 		.name = "mdio-rtl9300",
 		.of_match_table = otto_emdio_ids,
+		.suppress_bind_attrs = true,
 	},
 };
 
-- 
2.55.0