The Realtek MDIO driver relies on devm managed resources for lifetime management and allocates its internal central controller structure otto_emdio_priv via devm_kzalloc(). This can lead to a use-after-free in the following sitauation: - If the driver is unbound via sysfs the controller devm cleanup is triggered immediately. - However the MDIO buses are allocated with devm_mdiobus_alloc_size() and are reference counted. So if a MAC driver still holds a reference to a PHY device on the bus, the mii_bus will remain alive. - Any action that is run for the buses afterwards still relies on the availability of the central priv structure. This will access already freed memory. There are multiple possible solutions to mitigate that: - disable sysfs bind/unbind attributes - Clone all controller->priv data into the bus->priv structure. - Check for "bus->state != MDIOBUS_REGISTERED" in all callbacks Since this SoC-integrated MDIO controller cannot be physically hot-plugged and manual unbinding introduces potentially dangerous race conditions, set suppress_bind_attrs to true to prevent unbinding via sysfs. Signed-off-by: Markus Stockhausen --- drivers/net/mdio/mdio-realtek-rtl9300.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/mdio/mdio-realtek-rtl9300.c b/drivers/net/mdio/mdio-realtek-rtl9300.c index 73ac5fdcd267..1873928b362d 100644 --- a/drivers/net/mdio/mdio-realtek-rtl9300.c +++ b/drivers/net/mdio/mdio-realtek-rtl9300.c @@ -830,6 +830,7 @@ static struct platform_driver otto_emdio_driver = { .driver = { .name = "mdio-rtl9300", .of_match_table = otto_emdio_ids, + .suppress_bind_attrs = true, }, }; -- 2.55.0