Re: [PATCH net-next v2] net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

[Andrew Lunn]

On Fri, Nov 13, 2026 at 07:55:00AM +0000, Arun Iyengar via B4 Relay wrote:
> From: Arun Iyengar <aiyengar1990@xxxxxxxxx>
> 
> If mdio_mux_init() fails after the scan of the internal bus has powered
> the internal PHY (the external bus returns -EPROBE_DEFER, or an
> allocation fails), the dwmac_mux error path puts rst_ephy and ephy_clk
> and then calls stmmac_pltfr_remove(). sun8i_dwmac_exit() then unpowers
> the PHY through the clock and reset control that were just released.
> 
> Unpower the internal PHY before releasing them, as sun8i_dwmac_remove()
> does.
> 
> Fixes: 529254216773 ("net: stmmac: dwmac-sun8i: Balance internal PHY resource references")
> Signed-off-by: Arun Iyengar <aiyengar1990@xxxxxxxxx>
> ---
> Sashiko's review of another dwmac-sun8i series of mine pointed this
> out. Build-tested only (arm64 and arm, W=1): I have no board with the
> internal PHY (H3, H5 or V3s), so the error path was not exercised.
> 
> This patch was developed with Claude (Anthropic), which checked the
> report against the code and wrote the fix and the commit message. I
> reviewed it.
> ---
> Changes in v2:
> - Target net-next instead of net, drop Cc: stable (Andrew Lunn)

Maybe i was not explicitly, sorry. If it is for net-next, it should
not have a Fixes: tag.

	Andrew