Re: [PATCH 2/3] phy: core: Add common helper for get phy phandle by index

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Pre-existing race condition where the PHY module and device references are temporarily dropped before being re-acquired, risking a use-after-free.
--

commit 21ec40d6cb3e559164837267cde1582380a6bfd2
Author: Inochi Amaoto [off-list ref]

phy: core: Add common helper for get phy phandle by index

This commit refactors phy lookup by extracting the index-based retrieval
logic from of_phy_get() and devm_of_phy_get_by_index() into a new common
helper function, of_phy_get_by_index().

[ ... ]

-struct phy *of_phy_get(struct device_node *np, const char *con_id)
+static struct phy *of_phy_get_by_index(struct device_node *np, int index)
 {
-	struct phy *phy = NULL;
-	int index = 0;
-
-	if (con_id)
-		index = of_property_match_string(np, "phy-names", con_id);
+	struct phy *phy;
 
 	phy = _of_phy_get(np, index);
 	if (IS_ERR(phy))

[Severity: High]
This isn't a bug introduced by this patch, but is there a race condition
here that could lead to a use-after-free?

Looking at the full body of of_phy_get_by_index():

    phy = _of_phy_get(np, index);
    if (IS_ERR(phy))
            return phy;

    if (!try_module_get(phy->ops->owner))
            return ERR_PTR(-EPROBE_DEFER);

Inside _of_phy_get(), a module reference is temporarily acquired to call the
of_xlate() callback, but it is explicitly dropped via
module_put(phy_provider->owner) before returning the phy pointer.

Additionally, common of_xlate() implementations like of_phy_simple_xlate()
temporarily acquire a device reference but drop it via put_device() before
returning.

Could a concurrent sysfs unbind or module unload of the PHY driver free the
phy structure during the window between _of_phy_get() returning and
of_phy_get_by_index() evaluating phy->ops->owner?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831025506.95548-1-inochiama@gmail.com?part=2

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy