Re: [PATCH net-next v6 1/2] net: phy: refuse a second attach before touching the PHY

[Andrew Lunn <andrew@lunn.ch>]

On Tue, Oct 13, 2026 at 06:11:59PM +0300, Aleksei Sviridkin wrote:
> phy_attach_direct() tests phydev->attached_dev only after it has taken
> the driver module and, for a PHY with no driver, bound the generic one,
> and then leaves through the error path that calls
> phy_detach_internal(). That call works on the PHY's current attachment,
> so a second attach of a PHY in use tears down the first consumer: it
> clears that netdev's phydev pointer and the PHY's attached_dev, removes
> the sysfs links and suspends the PHY, while the first consumer goes on
> using it. A PHY on the generic driver never reaches the test: the
> attach runs its probe again and, when the bind fails, clears d->driver
> under the first consumer.
> 
> Found in review of a change that makes phy_detach() put only the
> module the attach recorded: with it, this path leaves the first
> consumer's reference pinned. On a Keenetic KN-1012, a test module
> attaching a second netdev to the EN8811H that the lan4 DSA port holds
> got -EBUSY and left lan4 with no PHY; with this change lan4 kept it.
> 
> Test whether the PHY is attached before the driver module is taken or
> the generic driver bound, and refuse from there. A PHY attached without
> a netdev, as DSA does for its CPU and link ports, has no attached_dev,
> so test phy_link_change, which every attach sets and every detach
> clears. A second attach of such a PHY used to succeed and share it;
> with that change it would also leak a module reference.
> 
> Assisted-by: LLM
> Signed-off-by: Aleksei Sviridkin <f@lex.la>

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew