Re: [PATCH net v2 RESEND] net: phy: nxp-tja11xx: cancel registration work on remove

[Andrew Lunn]

On Wed, Jul 29, 2026 at 05:27:14PM +0800, Hongyan Xu wrote:
> tja1102_p0_probe() schedules work to register the second port. That work
> uses the Port 0 private data and phydev. The private data is
> devm-allocated, but the driver does not cancel the work before detach.
> 
> If the device is removed before the worker runs, devres can free the
> private data while the pending work still dereferences it.
> 
> Store the Port 0 private data in phydev->priv and add a remove callback.
> The callback waits for the registration work before devres can free it.
> 
> This issue was found by a static analysis tool.
> 
> Fixes: 6a64d3cdc5ef ("net: phy: tja11xx: add delayed registration of TJA1102 PHY1")

I'm not sure this is worth a fixes tag. Does it bother people?

Have you managed to trigger it? It would need a script looking for the
first instance to pop into exists, and then unbinding the driver as
soon as it is created.

To me, this is yet another theoretical problem which never happens in
real life.

     Andrew