From: Arun Iyengar mdio_mux_init() registers the child MDIO buses one after the other. Scanning the internal bus makes mdio_mux_syscon_switch_fn() select the internal PHY and power it, which sets gmac->internal_phy_powered. If mdio_mux_init() then fails without switching away from the internal bus, for example because registering the external bus returns -EPROBE_DEFER before any access to it, or because an allocation for it fails, sun8i_dwmac_probe() jumps to dwmac_mux with the PHY still powered. That error path releases gmac->rst_ephy and gmac->ephy_clk and only then calls stmmac_pltfr_remove(), which ends in sun8i_dwmac_exit(). Since the PHY is still marked as powered, sun8i_dwmac_exit() calls sun8i_dwmac_unpower_internal_phy(), which passes the clock and the reset control that were just freed to clk_disable_unprepare() and reset_control_assert(). Unpower the internal PHY before releasing its clock and reset control, as sun8i_dwmac_remove() does. The later call from sun8i_dwmac_exit() then does nothing because internal_phy_powered is already cleared. Fixes: 529254216773 ("net: stmmac: dwmac-sun8i: Balance internal PHY resource references") Cc: stable@vger.kernel.org Signed-off-by: Arun Iyengar --- The problem was pointed out by the Sashiko AI review of an unrelated dwmac-sun8i series of mine. It holds against the code: clk_put() and reset_control_put() free the per-consumer struct clk and the exclusive reset control, and nothing between the dwmac_mux label and sun8i_dwmac_exit() clears internal_phy_powered. This is build-tested only (arm64 and arm, W=1). I have no board with the internal PHY (H3, H5 or V3s), so the error path was not exercised. This patch was developed with Claude (Anthropic) as a coding assistant: it checked the report against the code and wrote the fix and the commit message. I reviewed it. --- drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c index 47954537b29e..4436532af2dc 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c @@ -1245,6 +1245,7 @@ static int sun8i_dwmac_probe(struct platform_device *pdev) return 0; dwmac_mux: + sun8i_dwmac_unpower_internal_phy(gmac); reset_control_put(gmac->rst_ephy); clk_put(gmac->ephy_clk); dwmac_remove: --- base-commit: 145480b28ca82e9fae789427cc4569e596515a32 change-id: 20261112-sun8i-emac-mux-uaf-1ba885219fee Best regards, -- Arun Iyengar