From: Andrew Lunn <andrew@lunn•ch>
To: Robert Hancock <hancock@sedsystems•ca>
Cc: netdev@vger•kernel.org, Florian Fainelli <f.fainelli@gmail•com>,
Heiner Kallweit <hkallweit1@gmail•com>
Subject: Re: [PATCH net-next] net: phy: Ensure scheduled work is cancelled during removal
Date: Fri, 31 May 2019 22:54:21 +0200 [thread overview]
Message-ID: <20190531205421.GC3154@lunn.ch> (raw)
In-Reply-To: <1559330150-30099-2-git-send-email-hancock@sedsystems.ca>
Robert
Please make sure you Cc: PHY patches to the PHY maintainers.
Heiner, this one is for you.
Andrew
On Fri, May 31, 2019 at 01:15:50PM -0600, Robert Hancock wrote:
> It is possible that scheduled work started by the PHY driver is still
> outstanding when phy_device_remove is called if the PHY was initially
> started but never connected, and therefore phy_disconnect is never
> called. phy_stop does not guarantee that the scheduled work is stopped
> because it is called under rtnl_lock. This can cause an oops due to
> use-after-free if the delayed work fires after freeing the PHY device.
>
> Ensure that the state_queue work is cancelled in both phy_device_remove
> and phy_remove paths.
>
> Signed-off-by: Robert Hancock <hancock@sedsystems•ca>
> ---
> drivers/net/phy/phy_device.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
> index 2c879ba..1c90b33 100644
> --- a/drivers/net/phy/phy_device.c
> +++ b/drivers/net/phy/phy_device.c
> @@ -877,6 +877,8 @@ int phy_device_register(struct phy_device *phydev)
> */
> void phy_device_remove(struct phy_device *phydev)
> {
> + cancel_delayed_work_sync(&phydev->state_queue);
> +
> device_del(&phydev->mdio.dev);
>
> /* Assert the reset signal */
> --
> 1.8.3.1
>
next prev parent reply other threads:[~2019-05-31 20:54 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-31 19:15 [PATCH net-next] net: phy: xilinx: add Xilinx PHY driver Robert Hancock
2019-05-31 19:15 ` [PATCH net-next] net: phy: Ensure scheduled work is cancelled during removal Robert Hancock
2019-05-31 20:54 ` Andrew Lunn [this message]
2019-05-31 21:26 ` Heiner Kallweit
2019-06-01 3:22 ` hancock
2019-06-01 15:46 ` Andrew Lunn
2019-05-31 20:52 ` [PATCH net-next] net: phy: xilinx: add Xilinx PHY driver Andrew Lunn
2019-05-31 21:11 ` Florian Fainelli
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190531205421.GC3154@lunn.ch \
--to=andrew@lunn$(echo .)ch \
--cc=f.fainelli@gmail$(echo .)com \
--cc=hancock@sedsystems$(echo .)ca \
--cc=hkallweit1@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox