From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794061583; b=J0q529RVpJndnZOStVQmP6m3mef4dQHLyNFGoBouxWgt3HyhUcKmUSQrUsaC2RSemsW4 idehpMnsW1zIdzBeVfnkyNNc9SMeLooVe3S2uC5DZV3xTcrueQ/Jdibs32hLtfMAWDE4w KieHZjMq6oq1URn8ziPGhGmpSHIfo3khqrjOnX46jmIXiLrmzyCtwIhC6PcEEuP/ohPGF BZdGQ5wCYkFaPiTChTT+tk0HahqbMdyNt5vXkark215RgjP+Son2tEqCf66GQQZkcj5t5 K1vj+oR0RpsjglPy+96quhS9+anvdMczrrKz5vzEnu7NwT7loWW8dOYUqmFmsOICQNg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794061583; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=iFsNOgdjPIxaVHgile1VjkIqUX+HiBkvUxINFlWavO4=; b=QCsspgUfMx1yPMIuWn2GPlC3P5UXxrFPgw6kYq9ZeyDzoa3V+CSMB94eQbYlxp7pkBKU BU0tXAUkXGk49ZOeS5tElz2bI/Eg6n0VWkvgkEyUcpeSBvXUmdHctTDCRtEjEVmcgJNR7 JRAKOAviDX7HrCdiCh3KJ5JFGoIrOtoxrTw84tpkNObyZbRhqlngg7YolpDuVtT57D8g7 eAfhuu8fam8TjolJw6N4U/seNJbXv/xyP6S6R3EmeG1OLoxdoPFQKvdq+2YgdMibiX0T4 lmb1bm+FY9mtnIcgJnYCFTxikO/imyFQGsQRpCIE6bAvkoov0vgAtB6R2J0Cr5jtxVQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1rr1e0k8; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD4BC606A32D; Sat, 7 Nov 2026 14:26:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1rr1e0k8 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8896A1F008A1; Sat, 7 Nov 2026 14:26:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794061582; bh=iFsNOgdjPIxaVHgile1VjkIqUX+HiBkvUxINFlWavO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=1rr1e0k8iL50/TODxDz9c/0/YT6lM8bB2x/2ZDvAPpDlbXPVW5XukyZQT86BUUOdC k0jC0Tso1F0AFiYje8vxxH/3STA5IqweNebM/XtPuhhxXAvr+qxCfSieuQqa6AntP2 3FDsSt6ZtnSS+xGGAxLSDDTI9P5krEPFvzhTz8sI= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Manivannan Sadhasivam , Loic Poulain , Bryan ODonoghue , Vinod Koul , Oleg Keri Subject: [PATCH 6.12 0658/1536] phy: core: Fix race-condition between _of_phy_get() and try_module_get() Date: Sat, 7 Nov 2026 08:44:34 -0500 Message-ID: <20261107135016.005859143@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134957.653319350@linuxfoundation.org> References: <20261107134957.653319350@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Bryan O'Donoghue commit 090055ee629523092688da42428558ba56d4272f upstream. Sashiko asked during a patch review if the existing usage pattern had a race condition; specifically in of_phy_get() if it was possible between returning from _of_phy_get() and running try_module_get() that a module might be unbound leading to use-after-free. Looking at the code this appears to be so, there is no linkage between the phy and module under a synchronisation primitive. Using the phy_provider_mutex in phy_get() will ensure there is a link between the returned phy pointer and the module_get() bumping the module reference count. Amend phy_get(), of_phy_get() and devm_of_phy_get_by_index() to fix the same usage pattern. phy_provider_unregister() must take the phy_provider_mutex so amending phy_get()/of_phy_get() to take that same mutex guarantees there is no use-after-free. Fixes: ff764963479a1 ("drivers: phy: add generic PHY framework") Cc: stable@vger.kernel.org Reviewed-by: Manivannan Sadhasivam Reviewed-by: Loic Poulain Tested-by: Oleg Keri # Lenovo Yoga Slim 7x Gen 11 (Glymur) Signed-off-by: Bryan O'Donoghue Link: https://patch.msgid.link/20260918-b4-linux-next-25-03-13-dtsi-x1e80100-camss-v20-1-dc244e124e71@linaro.org Signed-off-by: Vinod Koul Signed-off-by: Greg Kroah-Hartman --- drivers/phy/phy-core.c | 45 ++++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) --- a/drivers/phy/phy-core.c +++ b/drivers/phy/phy-core.c @@ -124,13 +124,13 @@ static struct phy *phy_find(struct devic const char *dev_id = dev_name(dev); struct phy_lookup *p, *pl = NULL; - mutex_lock(&phy_provider_mutex); + lockdep_assert_held(&phy_provider_mutex); + list_for_each_entry(p, &phys, node) if (!strcmp(p->dev_id, dev_id) && !strcmp(p->con_id, con_id)) { pl = p; break; } - mutex_unlock(&phy_provider_mutex); return pl ? pl->phy : ERR_PTR(-ENODEV); } @@ -626,6 +626,8 @@ static struct phy *_of_phy_get(struct de struct phy *phy = NULL; struct of_phandle_args args; + lockdep_assert_held(&phy_provider_mutex); + ret = of_parse_phandle_with_args(np, "phys", "#phy-cells", index, &args); if (ret) @@ -637,11 +639,10 @@ static struct phy *_of_phy_get(struct de goto out_put_node; } - mutex_lock(&phy_provider_mutex); phy_provider = of_phy_provider_lookup(args.np); if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) { phy = ERR_PTR(-EPROBE_DEFER); - goto out_unlock; + goto out_put_node; } if (!of_device_is_available(args.np)) { @@ -655,8 +656,6 @@ static struct phy *_of_phy_get(struct de out_put_module: module_put(phy_provider->owner); -out_unlock: - mutex_unlock(&phy_provider_mutex); out_put_node: of_node_put(args.np); @@ -680,15 +679,21 @@ struct phy *of_phy_get(struct device_nod if (con_id) index = of_property_match_string(np, "phy-names", con_id); + mutex_lock(&phy_provider_mutex); + phy = _of_phy_get(np, index); if (IS_ERR(phy)) - return phy; + goto out_unlock; - if (!try_module_get(phy->ops->owner)) - return ERR_PTR(-EPROBE_DEFER); + if (!try_module_get(phy->ops->owner)) { + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; + } get_device(&phy->dev); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(of_phy_get); @@ -795,6 +800,7 @@ struct phy *phy_get(struct device *dev, struct phy *phy; struct device_link *link; + mutex_lock(&phy_provider_mutex); if (dev->of_node) { if (string) index = of_property_match_string(dev->of_node, "phy-names", @@ -805,15 +811,18 @@ struct phy *phy_get(struct device *dev, } else { if (string == NULL) { dev_WARN(dev, "missing string\n"); - return ERR_PTR(-EINVAL); + phy = ERR_PTR(-EINVAL); + goto out_unlock; } phy = phy_find(dev, string); } if (IS_ERR(phy)) - return phy; + goto out_unlock; - if (!try_module_get(phy->ops->owner)) - return ERR_PTR(-EPROBE_DEFER); + if (!try_module_get(phy->ops->owner)) { + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; + } get_device(&phy->dev); @@ -822,6 +831,8 @@ struct phy *phy_get(struct device *dev, dev_dbg(dev, "failed to create device link to %s\n", dev_name(phy->dev.parent)); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(phy_get); @@ -970,15 +981,17 @@ struct phy *devm_of_phy_get_by_index(str if (!ptr) return ERR_PTR(-ENOMEM); + mutex_lock(&phy_provider_mutex); phy = _of_phy_get(np, index); if (IS_ERR(phy)) { devres_free(ptr); - return phy; + goto out_unlock; } if (!try_module_get(phy->ops->owner)) { devres_free(ptr); - return ERR_PTR(-EPROBE_DEFER); + phy = ERR_PTR(-EPROBE_DEFER); + goto out_unlock; } get_device(&phy->dev); @@ -991,6 +1004,8 @@ struct phy *devm_of_phy_get_by_index(str dev_dbg(dev, "failed to create device link to %s\n", dev_name(phy->dev.parent)); +out_unlock: + mutex_unlock(&phy_provider_mutex); return phy; } EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);