Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1230441

[PATCH 4/9] phy: add proper phy struct device refcounting

Show all headers | View raw

Take a refcount on the phy struct device when the phy device is attached
to a network device, and drop it after it's detached.  This ensures that
a refcount is held on the phy device while the device is being used by
a network device, thereby preventing the phy_device from being
unexpectedly kfree()'d by phy_device_release().

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
---
 drivers/net/phy/phy_device.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 03adf328f49b..97a4f52addac 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -578,6 +578,7 @@ EXPORT_SYMBOL(phy_init_hw);
  *     generic driver is used.  The phy_device is given a ptr to
  *     the attaching device, and given a callback for link status
  *     change.  The phy_device is returned to the attaching driver.
+ *     This function takes a reference on the phy device.
  */
 int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 		      u32 flags, phy_interface_t interface)
@@ -591,6 +592,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 		return -EIO;
 	}
 
+	get_device(d);
+
 	/* Assume that if there is no driver, that it doesn't
 	 * exist, and we should use the genphy driver.
 	 */
@@ -636,6 +639,7 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
 	return err;
 
 error:
+	put_device(d);
 	module_put(bus->owner);
 	return err;
 }
@@ -679,6 +683,9 @@ EXPORT_SYMBOL(phy_attach);
 /**
  * phy_detach - detach a PHY device from its network device
  * @phydev: target phy_device struct
+ *
+ * This detaches the phy device from its network device and the phy
+ * driver, and drops the reference count taken in phy_attach_direct().
  */
 void phy_detach(struct phy_device *phydev)
 {
@@ -701,8 +708,13 @@ void phy_detach(struct phy_device *phydev)
 		}
 	}
 
+	/*
+	 * The phydev might go away on the put_device() below, so avoid
+	 * a use-after-free bug by reading the underlying bus first.
+	 */
 	bus = phydev->bus;
 
+	put_device(&phydev->dev);
 	module_put(bus->owner);
 }
 EXPORT_SYMBOL(phy_detach);
-- 
2.1.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v2 0/9] Phy, mdiobus, and netdev struct device fixes Russell King - ARM Linux <linux@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 8/9] phy: add phy_device_remove() Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 5/9] of_mdio: fix MDIO phy device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 6/9] net: fix phy refcounting in a bunch of drivers Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 9/9] net: fix net_device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 2/9] net: dsa: fix of_mdio_find_bus() device refcount leak Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 3/9] phy: fix mdiobus module safety Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  [PATCH 4/9] phy: add proper phy struct device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-22 18:20 +0200
  Re: [PATCH v2 0/9] Phy, mdiobus, and netdev struct device fixes David Miller <davem@davemloft.net> - 2015-09-24 01:30 +0200
    Re: [PATCH v2 0/9] Phy, mdiobus, and netdev struct device fixes Russell King - ARM Linux <linux@arm.linux.org.uk> - 2015-09-24 18:10 +0200
  [PATCH RESEND v3 2/9] net: dsa: fix of_mdio_find_bus() device  refcount leak Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 7/9] phy: fixed-phy: properly validate phy in  fixed_phy_update_state() Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 5/9] of_mdio: fix MDIO phy device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
    Re: [PATCH RESEND v3 5/9] of_mdio: fix MDIO phy device refcounting Rob Herring <robh@kernel.org> - 2015-09-25 00:30 +0200
  [PATCH RESEND v3 4/9] phy: add proper phy struct device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 8/9] phy: add phy_device_remove() Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 1/9] phy: fix of_mdio_find_bus() device refcount  leak Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 6/9] net: fix phy refcounting in a bunch of drivers Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 3/9] phy: fix mdiobus module safety Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:40 +0200
  [PATCH RESEND v3 9/9] net: fix net_device refcounting Russell King <rmk+kernel@arm.linux.org.uk> - 2015-09-24 21:50 +0200

csiph-web