Re: [PATCH net-next v2] net: phy: Fix suspicious rcu_dereference usage

[Eric Dumazet]

On Fri, Jan 17, 2025 at 6:36 PM Kory Maincent <kory.maincent@xxxxxxxxxxx> wrote:
>
> The phy_detach function can be called with or without the rtnl lock held.
> When the rtnl lock is not held, using rtnl_dereference() triggers a
> warning due to the lack of lock context.
>
> Add an rcu_read_lock() to ensure the lock is acquired and to maintain
> synchronization.
>
> Tested-by: Claudiu Beznea <claudiu.beznea.uj@xxxxxxxxxxxxxx>
> Reported-by: Claudiu Beznea <claudiu.beznea.uj@xxxxxxxxxxxxxx>
> Closes: https://lore.kernel.org/netdev/4c6419d8-c06b-495c-b987-d66c2e1ff848@xxxxxxxxx/
> Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
> Signed-off-by: Kory Maincent <kory.maincent@xxxxxxxxxxx>
> ---
>
> Changes in v2:
> - Add a missing ;
> ---
>  drivers/net/phy/phy_device.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
> index 5b34d39d1d52..3eeee7cba923 100644
> --- a/drivers/net/phy/phy_device.c
> +++ b/drivers/net/phy/phy_device.c
> @@ -2001,12 +2001,14 @@ void phy_detach(struct phy_device *phydev)
>         if (dev) {
>                 struct hwtstamp_provider *hwprov;
>
> -               hwprov = rtnl_dereference(dev->hwprov);
> +               rcu_read_lock();
> +               hwprov = rcu_dereference(dev->hwprov);
>                 /* Disable timestamp if it is the one selected */
>                 if (hwprov && hwprov->phydev == phydev) {
>                         rcu_assign_pointer(dev->hwprov, NULL);
>                         kfree_rcu(hwprov, rcu_head);
>                 }
> +               rcu_read_unlock();
>
>                 phydev->attached_dev->phydev = NULL;
>                 phydev->attached_dev = NULL;
> --
> 2.34.1
>

If not protected by RTNL, what prevents two threads from calling this
function at the same time,
thus attempting to kfree_rcu() the same pointer twice ?