From: Chenguang Zhao phylink_connect_phy() may be called from probe without RTNL while the net_device is still NETREG_UNINITIALIZED. If PHY bring-up fails, phy_detach() uses rtnl_dereference(dev->hwprov) and lockdep reports suspicious RCU usage. hwprov cannot have been assigned before register_netdevice(). Relax the RCU check for that state only; registered devices still require RTNL. Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice") Reported-by: syzbot+694b49f41098a5df4fd7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7 Signed-off-by: Chenguang Zhao --- drivers/net/phy/phy_device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 94b2e85e00a3..acd8d658a29e 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1941,7 +1941,9 @@ void phy_detach(struct phy_device *phydev) /* hwprov may technically be protected by ops lock but * not for devices with a phydev, see phy_link_topo_add_phy() */ - hwprov = rtnl_dereference(dev->hwprov); + hwprov = rcu_dereference_protected(dev->hwprov, + lockdep_rtnl_is_held() || + dev->reg_state == NETREG_UNINITIALIZED); /* Disable timestamp if it is the one selected */ if (hwprov && hwprov->phydev == phydev) { rcu_assign_pointer(dev->hwprov, NULL); -- 2.25.1