From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from vps0.lunn.ch (vps0.lunn.ch [156.67.10.101]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B3FC2EEE60; Tue, 13 Oct 2026 02:26:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=156.67.10.101 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791858379; cv=none; b=Mb+2/B2GpQxWSDCV+8CVKM7PDtRztTqrL5xU1w5KyAQ/8AnVx0IYduMeScZDMJfT9wpbmJ2ciSWEgxDLKAfWX3YDhc7GFmR9vG4EiKmTNIOukyWY8O3jICneRowwYJXFPUec36x3PBS4m3yxafDeHpGMjXWn0uBFVezvophmZ14= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791858379; c=relaxed/simple; bh=3kDh9heXE0eQtgr2hdakiBQbWCgX4gkYwgV8AcwPSgQ=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=AWebEVrEK0+EBGrU5y7SK+E9OBTZj2pEYobzF/OPaZmRFHsz1JmQvDy3Q51tvLNwpsbXzf+kK1oKEc7JJ9QiLVa9dwpreoZTnrhuXbL6H+jYRKxaj0ZYQtEeGg/u7Qh+5M12e3xsSkrjMHTLDqbNyLvbSmf3mjWL92ARCVC5L1E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lunn.ch; spf=pass smtp.mailfrom=lunn.ch; dkim=pass (1024-bit key) header.d=lunn.ch header.i=@lunn.ch header.b=NodwaO8/; arc=none smtp.client-ip=156.67.10.101 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=lunn.ch Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=lunn.ch Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=lunn.ch header.i=@lunn.ch header.b="NodwaO8/" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lunn.ch; s=20171124; h=In-Reply-To:Content-Disposition:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:From:Sender:Reply-To:Subject: Date:Message-ID:To:Cc:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Content-Disposition:In-Reply-To:References; bh=YTjFqI63+E/Jzn1291GKAg1+nViSz6vqdQACq7dN2MM=; b=NodwaO8/zTBryUuw/vbS1bqQl0 99Y1a9QJ2rtS4WYv5DSuvmlYtahVz4ATsRlhMDQImHmK7/QGeHRvuJiMLh6jQdhVKXYYOqA7JuKvF YHjrsq6Nlmq1jb/gAhK7xLyuqYSDyTRU42ahDWeCj+7SHfl3jlAH4Ge2IQwHWsN/NrZs=; Received: from andrew by vps0.lunn.ch with local (Exim 4.94.2) (envelope-from ) id 1xGSDO-00AR9o-UL; Tue, 13 Oct 2026 04:26:06 +0200 Date: Tue, 13 Oct 2026 04:26:06 +0200 From: Andrew Lunn To: Aleksei Sviridkin Cc: Heiner Kallweit , Russell King , netdev@vger.kernel.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-kernel@vger.kernel.org, Florian Fainelli , Woojung Huh , Vladimir Oltean , Maxime Chevallier Subject: Re: [PATCH net-next v5 2/4] net: phy: put the driver module the attach took Message-ID: <2b95dbf5-3ab5-4eaa-88d0-efb93ddb808b@lunn.ch> References: <20261009180551.1234107-1-f@lex.la> <20261009180551.1234107-3-f@lex.la> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20261009180551.1234107-3-f@lex.la> On Fri, Oct 09, 2026 at 09:05:48PM +0300, Aleksei Sviridkin wrote: > phy_attach_direct() pins the PHY driver module through d->driver, and > phy_detach() releases it by reading d->driver again. Unbinding the PHY > driver while the PHY is attached clears that pointer, so a detach that > runs while the driver is still unbound skips the put and the module can > no longer be unloaded; if a different driver binds in between, the put > lands on a module that was never pinned. The NULL test added by > commit c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver > is unbound") avoids the oops but skips the put. > > Found by reading phy_detach() while chasing a PHY driver unbind race on > a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak > itself was not observed there: unbinding air_en8811h under the attached > lan4 DSA port and then unbinding the switch faults earlier on that > board, in phy_free_interrupt() or under phy_stop(), before > phy_detach() gets to the put. > > Remember which module was pinned and release that one. > > Fixes: cafe8df8b9bc ("net: phy: Fix lack of reference count on PHY driver") > Assisted-by: LLM > Signed-off-by: Aleksei Sviridkin > --- > Changes in v5: > - The driver module is read once, so the module pinned and the module > recorded cannot differ. > - Rebased on net-next: the failed generic bind unwind keeps the > interrupt restore it got there. Please drop the fixes tag when it is for net-next. You can then add: Reviewed-by: Andrew Lunn Andrew --- pw-bot: cr