Re: [PATCH net v2 05/14] net: pse-pd: do not reach a freed PHY from the notification worker

[Oleksij Rempel]

CCing: Maxime Chevallier <maxime.chevallier@xxxxxxxxxxx>
for phy_port part.

On Tue, Oct 20, 2026 at 07:12:40PM +0200, Carlo Szelinsky wrote:
> The notification worker holds a reference on the pse_control, but not
> on the PHY that psec->attached_phydev points to. If the PHY is removed
> while the worker runs, the pse_control survives and the worker reads the
> freed PHY. The same happens without a race when two PHYs share one PI:
> attached_phydev keeps pointing at the first PHY after it is removed.
> 
> pse_control_put() unlinks and frees a pse_control under pse_list_mutex,
> and phy_device_remove() calls it before the PHY is freed. So instead of
> taking a reference, let the worker look the pse_control up and use
> attached_phydev under pse_list_mutex. This nests pse_list_mutex inside
> rtnl; nothing under pse_list_mutex takes rtnl.
> 
> For a PI shared by two PHYs there is no single netdev to report to, so
> clear attached_phydev when a second PHY takes the pse_control, and warn.
> Events for that PI are then no longer reported, even after one PHY goes
> away. Failing the second PHY instead would fail its whole MDIO bus.

A PI shared by two PHYs on one connector is a rare setup and no in-tree
DT has one (prtt1c gives each PHY its own PI), so dropping its events is
fine for this fix.

If this is ever lifted, the PI should hang off the port rather than a
PHY: a PI powers a connector, and with phy_port
(Documentation/networking/phy-port.rst) net-next already has a port
object to attach it to. That is net-next work, not for this series.

Acked-by: Oleksij Rempel <o.rempel@xxxxxxxxxxxxxx>
-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |