Re: [PATCH net-next v5 2/4] net: phy: put the driver module the attach took

[Andrew Lunn <andrew@lunn.ch>]

On Fri, Oct 09, 2026 at 09:05:48PM +0300, Aleksei Sviridkin wrote:
> phy_attach_direct() pins the PHY driver module through d->driver, and
> phy_detach() releases it by reading d->driver again. Unbinding the PHY
> driver while the PHY is attached clears that pointer, so a detach that
> runs while the driver is still unbound skips the put and the module can
> no longer be unloaded; if a different driver binds in between, the put
> lands on a module that was never pinned. The NULL test added by
> commit c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver
> is unbound") avoids the oops but skips the put.
> 
> Found by reading phy_detach() while chasing a PHY driver unbind race on
> a Keenetic KN-1012 (MT7981, air_en8811h built as a module). The leak
> itself was not observed there: unbinding air_en8811h under the attached
> lan4 DSA port and then unbinding the switch faults earlier on that
> board, in phy_free_interrupt() or under phy_stop(), before
> phy_detach() gets to the put.
> 
> Remember which module was pinned and release that one.
> 
> Fixes: cafe8df8b9bc ("net: phy: Fix lack of reference count on PHY driver")
> Assisted-by: LLM
> Signed-off-by: Aleksei Sviridkin <f@lex.la>
> ---
> Changes in v5:
> - The driver module is read once, so the module pinned and the module
>   recorded cannot differ.
> - Rebased on net-next: the failed generic bind unwind keeps the
>   interrupt restore it got there.

Please drop the fixes tag when it is for net-next.

You can then add: Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

---
pw-bot: cr