[PATCH net-next v6 2/2] net: phy: put the driver module the attach took
flat view
WARM3d
IN NET-NEXT: 1 (1M)
From: Aleksei Sviridkin <hidden>
Date: 2026-10-13 15:12:11
Also in:
lkml
Subsystem:
ethernet phy library, networking drivers, the rest · Maintainers:
Andrew Lunn, Heiner Kallweit, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
1 review trailer (1 from subsystem maintainers); queued in net-next as 7151b86654fa on 2026-10-17.
phy_attach_direct() pins the PHY driver module through d->driver, and
phy_detach() releases it by reading d->driver again. Unbinding the PHY
driver while the PHY is attached clears that pointer, so a detach that
runs while the driver is still unbound skips the put and the module can
no longer be unloaded; if a different driver binds in between, the put
lands on a module that was never pinned. The NULL test added by
commit c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver
is unbound") avoids the oops but skips the put.
Found by reading phy_detach() while chasing a PHY driver unbind race on
a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak
itself was not observed there: unbinding air_en8811h under the attached
lan4 DSA port and then unbinding the switch faults earlier on that
board, in phy_free_interrupt() or under phy_stop(), before
phy_detach() gets to the put.
Remember which module was pinned and release that one.
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <redacted>
---
v6: dropped the Fixes tag, added Andrew's Reviewed-by.
drivers/net/phy/phy_device.c | 12 ++++++++----
include/linux/phy.h | 2 ++
2 files changed, 10 insertions(+), 4 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 6bc9cdb7fa69..68691c487eee 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c@@ -1728,8 +1728,8 @@ static void phy_detach_internal(struct phy_device *phydev, bool notify_bus) phydev->phy_link_change = NULL; phydev->phylink = NULL; - if (phydev->mdio.dev.driver) - module_put(phydev->mdio.dev.driver->owner); + module_put(phydev->drv_owner); + phydev->drv_owner = NULL; /* If the device had no specific driver before (i.e. - it * was using the generic driver), we unbind the device
@@ -1794,6 +1794,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, struct mii_bus *bus = phydev->mdio.bus; struct device *d = &phydev->mdio.dev; struct module *ndev_owner = NULL; + struct module *drv_owner; int irq = phydev->irq; int err;
@@ -1830,11 +1831,13 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, phydev->is_genphy_driven = 1; } - if (!try_module_get(d->driver->owner)) { + drv_owner = d->driver->owner; + if (!try_module_get(drv_owner)) { phydev_err(phydev, "failed to get the device driver module\n"); err = -EIO; goto error_put_device; } + phydev->drv_owner = drv_owner; if (phydev->is_genphy_driven) { err = d->driver->probe(d);
@@ -1942,7 +1945,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, return err; error_module_put: - module_put(d->driver->owner); + module_put(phydev->drv_owner); + phydev->drv_owner = NULL; phydev->irq = irq; phydev->is_genphy_driven = 0; d->driver = NULL;
diff --git a/include/linux/phy.h b/include/linux/phy.h
index 7c5098a0dd6c..a5a419bc400e 100644
--- a/include/linux/phy.h
+++ b/include/linux/phy.h@@ -578,6 +578,7 @@ struct phy_oatc14_sqi_capability { * * @mdio: MDIO bus this PHY is on * @drv: Pointer to the driver for this PHY instance + * @drv_owner: Driver module phy_attach_direct() took a reference on * @devlink: Create a link between phy dev and mac dev, if the external phy * used by current mac interface is managed by another mac interface. * @phyindex: Unique id across the phy's parent tree of phys to address the PHY
@@ -689,6 +690,7 @@ struct phy_device { /* Information about the PHY type */ /* And management functions */ const struct phy_driver *drv; + struct module *drv_owner; struct device_link *devlink;
--
2.53.0