During device probe (for example, in ax88772_bind()), drivers may invoke
phylink_connect_phy() before the net_device is registered (while
dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
If connecting or bringing up the PHY fails inside phylink_connect_phy(),
the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
usage warning:
WARNING: suspicious RCU usage
drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
usage!
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
Fix this by using rcu_dereference_protected() in phy_detach() with a
condition checking whether the RTNL lock is held or dev->reg_state !=
NETREG_REGISTERED. This allows safe cleanup on probe failure before device
registration without requiring drivers to acquire the RTNL lock.
Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
Assisted-by: Gemini:gemini-3.7-flash syzbot
Reported-by: syzbot+694b49f41098a5df4fd7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7
Link: https://syzkaller.appspot.com/ai_job?id=63daf6f3-5d22-4261-b346-dfd3a5537965
To: "Andrew Lunn"
To: "David S. Miller"
To: "Eric Dumazet"
To: "Heiner Kallweit"
To: "Jakub Kicinski"
To:
To: "Paolo Abeni"
To: "Kory Maincent"
Cc:
Cc: "Russell King"
---
v3:
- Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().
v2:
- Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
- Updated the commit subject and description to reflect the changes in phylib.
https://lore.kernel.org/all/5a7201b1-c826-4855-9105-3caa58977bc3@mail.kernel.org/T/
v1:
https://lore.kernel.org/all/2835933a-117e-405a-a369-86459e8c8299@mail.kernel.org/T/
---
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 94b2e85e0..ac09943e1 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
struct hwtstamp_provider *hwprov;
/* hwprov may technically be protected by ops lock but
- * not for devices with a phydev, see phy_link_topo_add_phy()
+ * not for devices with a phydev, see phy_link_topo_add_phy().
+ * RTNL is not held when cleaning up on probe failure before
+ * device registration.
*/
- hwprov = rtnl_dereference(dev->hwprov);
+ hwprov = rcu_dereference_protected(dev->hwprov,
+ lockdep_rtnl_is_held() ||
+ dev->reg_state != NETREG_REGISTERED);
/* Disable timestamp if it is the one selected */
if (hwprov && hwprov->phydev == phydev) {
rcu_assign_pointer(dev->hwprov, NULL);
base-commit: df2908090cda368b01ff43709f51890076c56157
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.