[PATCH net 00/10] net: Move setting of netops to fix crash

[PATCH net 00/10] net: Move setting of netops to fix crash

[David Yang]

Commit ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev()
locking assertion") put a netdev_need_ops_lock() check on the
phy_attach_direct() path, in phy_link_topo_add_phy(). With
CONFIG_NET_SHAPER enabled netdev_need_ops_lock() reads
dev->netdev_ops->net_shaper_ops, so any driver that connects a PHY
before assigning ndev->netdev_ops now dies with a NULL pointer
dereference at probe time. The breakage showed up in v7.3-rc1.

ibm/emac was hit first and fixed by commit 7c9f391ec89c ("net: emac:
move setting of netops to fix crash"). These ten patches apply the
same one-line move to the remaining in-tree drivers whose probe path
attaches a PHY before filling in netdev_ops:

  1. hisilicon/hisi_femac   (crash reproduced on hardware)
  2. hisilicon/hip04
  3. actions/owl-emac
  4. adi/adin1140
  5. marvell/mv643xx_eth
  6. amd/au1000_eth
  7. ethoc
  8. aeroflex/greth
  9. ti/icssm-prueth
 10. microchip/lan865x      (attach happens inside oa_tc6_init())

Only patch 1 was reproduced and verified on hardware; patches 2-10
were found by source inspection and are neither build nor boot
tested.

Note that ti/netcp_ethss and cavium/thunder_bgx attach a PHY to
netdevs that never get a netdev_ops at all (dummy netdevs), so they
cannot be fixed by reordering and are not addressed here.

David Yang (10):
  net: hisilicon: hisi_femac: Move setting of netops to fix crash
  net: hisilicon: hip04_eth: Move setting of netops to fix crash
  net: ethernet: actions: Move setting of netops to fix crash
  net: ethernet: adi: Move setting of netops to fix crash
  net: mv643xx: move setting of netops to fix crash
  net: au1000: move setting of netops to fix crash
  net: ethoc: move setting of netops to fix crash
  net: ethernet: aeroflex: move setting of netops to fix crash
  net: ti: icssm-prueth: Move setting of netops to fix crash
  microchip: lan865x: move setting of netops to fix crash

 drivers/net/ethernet/actions/owl-emac.c          | 3 ++-
 drivers/net/ethernet/adi/adin1140.c              | 3 ++-
 drivers/net/ethernet/aeroflex/greth.c            | 3 ++-
 drivers/net/ethernet/amd/au1000_eth.c            | 3 ++-
 drivers/net/ethernet/ethoc.c                     | 3 ++-
 drivers/net/ethernet/hisilicon/hip04_eth.c       | 3 ++-
 drivers/net/ethernet/hisilicon/hisi_femac.c      | 3 ++-
 drivers/net/ethernet/marvell/mv643xx_eth.c       | 4 ++--
 drivers/net/ethernet/microchip/lan865x/lan865x.c | 3 ++-
 drivers/net/ethernet/ti/icssm/icssm_prueth.c     | 3 ++-
 10 files changed, 20 insertions(+), 11 deletions(-)

-- 
2.53.0

[PATCH net 01/10] net: hisilicon: hisi_femac: Move setting of netops to fix crash

[David Yang]

hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.

  phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c
  of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558
  Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/hisilicon/hisi_femac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c
index d244a40df430..016605e86f0b 100644
--- a/drivers/net/ethernet/hisilicon/hisi_femac.c
+++ b/drivers/net/ethernet/hisilicon/hisi_femac.c
@@ -830,6 +830,8 @@ static int hisi_femac_drv_probe(struct platform_device *pdev)
 		hisi_femac_phy_reset(priv);
 	}
 
+	ndev->netdev_ops = &hisi_femac_netdev_ops;
+
 	phy = of_phy_get_and_connect(ndev, node, hisi_femac_adjust_link);
 	if (!phy) {
 		dev_err(dev, "connect to PHY failed!\n");
@@ -850,7 +852,6 @@ static int hisi_femac_drv_probe(struct platform_device *pdev)
 
 	ndev->watchdog_timeo = 6 * HZ;
 	ndev->priv_flags |= IFF_UNICAST_FLT;
-	ndev->netdev_ops = &hisi_femac_netdev_ops;
 	ndev->ethtool_ops = &hisi_femac_ethtools_ops;
 	netif_napi_add_weight(ndev, &priv->napi, hisi_femac_poll,
 			      FEMAC_POLL_WEIGHT);
-- 
2.53.0

[PATCH net 02/10] net: hisilicon: hip04_eth: Move setting of netops to fix crash

[David Yang]

hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/hisilicon/hip04_eth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
index fc2c47dcfaab..d0409de5c553 100644
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -976,6 +976,8 @@ static int hip04_mac_probe(struct platform_device *pdev)
 		goto init_fail;
 	}
 
+	ndev->netdev_ops = &hip04_netdev_ops;
+
 	priv->phy_node = of_parse_phandle(node, "phy-handle", 0);
 	if (priv->phy_node) {
 		priv->phy = of_phy_connect(ndev, priv->phy_node,
@@ -989,7 +991,6 @@ static int hip04_mac_probe(struct platform_device *pdev)
 
 	INIT_WORK(&priv->tx_timeout_task, hip04_tx_timeout_task);
 
-	ndev->netdev_ops = &hip04_netdev_ops;
 	ndev->ethtool_ops = &hip04_ethtool_ops;
 	ndev->watchdog_timeo = TX_TIMEOUT;
 	ndev->priv_flags |= IFF_UNICAST_FLT;
-- 
2.53.0

[PATCH net 03/10] net: ethernet: actions: Move setting of netops to fix crash

[David Yang]

owl_emac_probe() calls owl_emac_phy_init(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/actions/owl-emac.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/actions/owl-emac.c b/drivers/net/ethernet/actions/owl-emac.c
index 0a08da799255..2538275a1e57 100644
--- a/drivers/net/ethernet/actions/owl-emac.c
+++ b/drivers/net/ethernet/actions/owl-emac.c
@@ -1552,6 +1552,8 @@ static int owl_emac_probe(struct platform_device *pdev)
 		return ret;
 	}
 
+	netdev->netdev_ops = &owl_emac_netdev_ops;
+
 	ret = owl_emac_phy_init(netdev);
 	if (ret) {
 		dev_err(dev, "failed to initialize PHY\n");
@@ -1563,7 +1565,6 @@ static int owl_emac_probe(struct platform_device *pdev)
 	netdev->min_mtu = OWL_EMAC_MTU_MIN;
 	netdev->max_mtu = OWL_EMAC_MTU_MAX;
 	netdev->watchdog_timeo = OWL_EMAC_TX_TIMEOUT;
-	netdev->netdev_ops = &owl_emac_netdev_ops;
 	netdev->ethtool_ops = &owl_emac_ethtool_ops;
 	netif_napi_add(netdev, &priv->napi, owl_emac_poll);
 
-- 
2.53.0

[PATCH net 04/10] net: ethernet: adi: Move setting of netops to fix crash

[David Yang]

adin1140_probe() calls adin1140_phy_init(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/adi/adin1140.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/adi/adin1140.c b/drivers/net/ethernet/adi/adin1140.c
index 93710baca151..ca96a919c24b 100644
--- a/drivers/net/ethernet/adi/adin1140.c
+++ b/drivers/net/ethernet/adi/adin1140.c
@@ -733,6 +733,8 @@ static int adin1140_probe(struct spi_device *spi)
 	if (ret)
 		return ret;
 
+	netdev->netdev_ops = &adin1140_netdev_ops;
+
 	ret = adin1140_phy_init(priv, spi);
 	if (ret)
 		return ret;
@@ -748,7 +750,6 @@ static int adin1140_probe(struct spi_device *spi)
 
 	netdev->if_port = IF_PORT_10BASET;
 	netdev->irq = spi->irq;
-	netdev->netdev_ops = &adin1140_netdev_ops;
 	netdev->ethtool_ops = &adin1140_ethtool_ops;
 	netdev->netns_immutable = true;
 	netdev->priv_flags |= IFF_LIVE_ADDR_CHANGE |
-- 
2.53.0

[PATCH net 05/10] net: mv643xx: move setting of netops to fix crash

[David Yang]

mv643xx_eth_probe() connects the PHY before dev->netdev_ops is
assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
dev->netdev_ops through netdev_need_ops_lock() since the commit in
question, so probing crashes with a NULL pointer dereference when
CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index 9caa1e47c174..38b4d65f58a5 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -3171,6 +3171,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
 	netif_set_real_num_tx_queues(dev, mp->txq_count);
 	netif_set_real_num_rx_queues(dev, mp->rxq_count);
 
+	dev->netdev_ops = &mv643xx_eth_netdev_ops;
+
 	err = 0;
 	if (pd->phy_node) {
 		phydev = of_phy_connect(mp->dev, pd->phy_node,
@@ -3221,8 +3223,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
 	}
 	dev->irq = irq;
 
-	dev->netdev_ops = &mv643xx_eth_netdev_ops;
-
 	dev->watchdog_timeo = 2 * HZ;
 	dev->base_addr = 0;
 
-- 
2.53.0

[PATCH net 06/10] net: au1000: move setting of netops to fix crash

[David Yang]

au1000_probe() calls au1000_mii_probe(), which connects the PHY,
before dev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/amd/au1000_eth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
index 5a04056e38fa..8682323d693f 100644
--- a/drivers/net/ethernet/amd/au1000_eth.c
+++ b/drivers/net/ethernet/amd/au1000_eth.c
@@ -1225,6 +1225,8 @@ static int au1000_probe(struct platform_device *pdev)
 		goto err_mdiobus_reg;
 	}
 
+	dev->netdev_ops = &au1000_netdev_ops;
+
 	err = au1000_mii_probe(dev);
 	if (err != 0)
 		goto err_out;
@@ -1263,7 +1265,6 @@ static int au1000_probe(struct platform_device *pdev)
 
 	dev->base_addr = base->start;
 	dev->irq = irq;
-	dev->netdev_ops = &au1000_netdev_ops;
 	dev->ethtool_ops = &au1000_ethtool_ops;
 	dev->watchdog_timeo = ETH_TX_TIMEOUT;
 
-- 
2.53.0

[PATCH net 07/10] net: ethoc: move setting of netops to fix crash

[David Yang]

ethoc_probe() calls ethoc_mdio_probe(), which connects the PHY,
before netdev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/ethoc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c
index 0c418557264c..e5b7df43e8f6 100644
--- a/drivers/net/ethernet/ethoc.c
+++ b/drivers/net/ethernet/ethoc.c
@@ -1211,6 +1211,8 @@ static int ethoc_probe(struct platform_device *pdev)
 		goto free3;
 	}
 
+	netdev->netdev_ops = &ethoc_netdev_ops;
+
 	ret = ethoc_mdio_probe(netdev);
 	if (ret) {
 		dev_err(&netdev->dev, "failed to probe MDIO bus\n");
@@ -1218,7 +1220,6 @@ static int ethoc_probe(struct platform_device *pdev)
 	}
 
 	/* setup the net_device structure */
-	netdev->netdev_ops = &ethoc_netdev_ops;
 	netdev->watchdog_timeo = ETHOC_TIMEOUT;
 	netdev->features |= 0;
 	netdev->ethtool_ops = &ethoc_ethtool_ops;
-- 
2.53.0

[PATCH net 08/10] net: ethernet: aeroflex: move setting of netops to fix crash

[David Yang]

greth_of_probe() calls greth_mdio_init(), which connects the PHY,
before dev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/aeroflex/greth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c
index a593adc16c78..fccb67beebee 100644
--- a/drivers/net/ethernet/aeroflex/greth.c
+++ b/drivers/net/ethernet/aeroflex/greth.c
@@ -1421,6 +1421,8 @@ static int greth_of_probe(struct platform_device *ofdev)
 	/* Check if MAC can handle MDIO interrupts */
 	greth->mdio_int_en = (tmp >> 26) & 1;
 
+	dev->netdev_ops = &greth_netdev_ops;
+
 	err = greth_mdio_init(greth);
 	if (err) {
 		if (netif_msg_probe(greth))
@@ -1498,7 +1500,6 @@ static int greth_of_probe(struct platform_device *ofdev)
 		dev->flags &= ~IFF_MULTICAST;
 	}
 
-	dev->netdev_ops = &greth_netdev_ops;
 	dev->ethtool_ops = &greth_ethtool_ops;
 
 	err = register_netdev(dev);
-- 
2.53.0

[PATCH net 09/10] net: ti: icssm-prueth: Move setting of netops to fix crash

[David Yang]

icssm_prueth_netdev_init() calls of_phy_get_and_connect() before
ndev->netdev_ops is assigned. phy_attach_direct() ->
phy_link_topo_add_phy() reads dev->netdev_ops through
netdev_need_ops_lock() since the commit in question, so probing crashes
with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/ti/icssm/icssm_prueth.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/ti/icssm/icssm_prueth.c b/drivers/net/ethernet/ti/icssm/icssm_prueth.c
index b7e94244355a..b42c98e861e0 100644
--- a/drivers/net/ethernet/ti/icssm/icssm_prueth.c
+++ b/drivers/net/ethernet/ti/icssm/icssm_prueth.c
@@ -1563,6 +1563,8 @@ static int icssm_prueth_netdev_init(struct prueth *prueth,
 	}
 	ether_addr_copy(emac->mac_addr, ndev->dev_addr);
 
+	ndev->netdev_ops = &emac_netdev_ops;
+
 	/* connect PHY */
 	emac->phydev = of_phy_get_and_connect(ndev, eth_node,
 					      icssm_emac_adjust_link);
@@ -1590,7 +1592,6 @@ static int icssm_prueth_netdev_init(struct prueth *prueth,
 	}
 
 	ndev->dev.of_node = eth_node;
-	ndev->netdev_ops = &emac_netdev_ops;
 
 	netif_napi_add(ndev, &emac->napi, icssm_emac_napi_poll);
 
-- 
2.53.0

[PATCH net 10/10] microchip: lan865x: move setting of netops to fix crash

[David Yang]

lan865x_probe() assigns netdev_ops only after oa_tc6_init(), which
connects the internal MAC-PHY through phy_connect_direct().
phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops
through netdev_need_ops_lock() since the commit in question, so probing
crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is
enabled.

Assign netdev_ops before the PHY attach, as was done for emac in commit
7c9f391ec89c ("net: emac: move setting of netops to fix crash").

Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
Signed-off-by: David Yang <mmyangfl@gmail.com>
---
 drivers/net/ethernet/microchip/lan865x/lan865x.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/microchip/lan865x/lan865x.c b/drivers/net/ethernet/microchip/lan865x/lan865x.c
index 26a2761332a5..633d00857774 100644
--- a/drivers/net/ethernet/microchip/lan865x/lan865x.c
+++ b/drivers/net/ethernet/microchip/lan865x/lan865x.c
@@ -346,6 +346,8 @@ static int lan865x_probe(struct spi_device *spi)
 	spi_set_drvdata(spi, priv);
 	INIT_WORK(&priv->multicast_work, lan865x_multicast_work_handler);
 
+	netdev->netdev_ops = &lan865x_netdev_ops;
+
 	priv->tc6 = oa_tc6_init(spi, netdev, NULL);
 	if (!priv->tc6) {
 		ret = -ENODEV;
@@ -397,7 +399,6 @@ static int lan865x_probe(struct spi_device *spi)
 
 	netdev->if_port = IF_PORT_10BASET;
 	netdev->irq = spi->irq;
-	netdev->netdev_ops = &lan865x_netdev_ops;
 	netdev->ethtool_ops = &lan865x_ethtool_ops;
 
 	ret = register_netdev(netdev);
-- 
2.53.0

Re: [PATCH net 02/10] net: hisilicon: hip04_eth: Move setting of netops to fix crash

[Maxime Chevallier]

On 10/8/26 04:26, David Yang wrote:
> hip04_mac_probe() calls of_phy_connect() before ndev->netdev_ops is
> assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
> dev->netdev_ops through netdev_need_ops_lock() since the commit in
> question, so probing crashes with a NULL pointer dereference when
> CONFIG_NET_SHAPER is enabled.
> 
> Assign netdev_ops before the PHY attach, as was done for emac in commit
> 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
> 
> Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
> Signed-off-by: David Yang <mmyangfl@gmail.com>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Thanks,

Maxime

> ---
>  drivers/net/ethernet/hisilicon/hip04_eth.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/hisilicon/hip04_eth.c b/drivers/net/ethernet/hisilicon/hip04_eth.c
> index fc2c47dcfaab..d0409de5c553 100644
> --- a/drivers/net/ethernet/hisilicon/hip04_eth.c
> +++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
> @@ -976,6 +976,8 @@ static int hip04_mac_probe(struct platform_device *pdev)
>  		goto init_fail;
>  	}
>  
> +	ndev->netdev_ops = &hip04_netdev_ops;
> +
>  	priv->phy_node = of_parse_phandle(node, "phy-handle", 0);
>  	if (priv->phy_node) {
>  		priv->phy = of_phy_connect(ndev, priv->phy_node,
> @@ -989,7 +991,6 @@ static int hip04_mac_probe(struct platform_device *pdev)
>  
>  	INIT_WORK(&priv->tx_timeout_task, hip04_tx_timeout_task);
>  
> -	ndev->netdev_ops = &hip04_netdev_ops;
>  	ndev->ethtool_ops = &hip04_ethtool_ops;
>  	ndev->watchdog_timeo = TX_TIMEOUT;
>  	ndev->priv_flags |= IFF_UNICAST_FLT;

Re: [PATCH net 06/10] net: au1000: move setting of netops to fix crash

[Maxime Chevallier]

On 10/8/26 04:26, David Yang wrote:
> au1000_probe() calls au1000_mii_probe(), which connects the PHY,
> before dev->netdev_ops is assigned. phy_attach_direct() ->
> phy_link_topo_add_phy() reads dev->netdev_ops through
> netdev_need_ops_lock() since the commit in question, so probing crashes
> with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled.
> 
> Assign netdev_ops before the PHY attach, as was done for emac in commit
> 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
> 
> Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
> Signed-off-by: David Yang <mmyangfl@gmail.com>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Thanks,

Maxime

> ---
>  drivers/net/ethernet/amd/au1000_eth.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amd/au1000_eth.c b/drivers/net/ethernet/amd/au1000_eth.c
> index 5a04056e38fa..8682323d693f 100644
> --- a/drivers/net/ethernet/amd/au1000_eth.c
> +++ b/drivers/net/ethernet/amd/au1000_eth.c
> @@ -1225,6 +1225,8 @@ static int au1000_probe(struct platform_device *pdev)
>  		goto err_mdiobus_reg;
>  	}
>  
> +	dev->netdev_ops = &au1000_netdev_ops;
> +
>  	err = au1000_mii_probe(dev);
>  	if (err != 0)
>  		goto err_out;
> @@ -1263,7 +1265,6 @@ static int au1000_probe(struct platform_device *pdev)
>  
>  	dev->base_addr = base->start;
>  	dev->irq = irq;
> -	dev->netdev_ops = &au1000_netdev_ops;
>  	dev->ethtool_ops = &au1000_ethtool_ops;
>  	dev->watchdog_timeo = ETH_TX_TIMEOUT;
>  

Re: [PATCH net 10/10] microchip: lan865x: move setting of netops to fix crash

[Maxime Chevallier]

On 10/8/26 04:26, David Yang wrote:
> lan865x_probe() assigns netdev_ops only after oa_tc6_init(), which
> connects the internal MAC-PHY through phy_connect_direct().
> phy_attach_direct() -> phy_link_topo_add_phy() reads dev->netdev_ops
> through netdev_need_ops_lock() since the commit in question, so probing
> crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is
> enabled.
> 
> Assign netdev_ops before the PHY attach, as was done for emac in commit
> 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
> 
> Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
> Signed-off-by: David Yang <mmyangfl@gmail.com>

Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>

Thanks,

Maxime

> ---
>  drivers/net/ethernet/microchip/lan865x/lan865x.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/microchip/lan865x/lan865x.c b/drivers/net/ethernet/microchip/lan865x/lan865x.c
> index 26a2761332a5..633d00857774 100644
> --- a/drivers/net/ethernet/microchip/lan865x/lan865x.c
> +++ b/drivers/net/ethernet/microchip/lan865x/lan865x.c
> @@ -346,6 +346,8 @@ static int lan865x_probe(struct spi_device *spi)
>  	spi_set_drvdata(spi, priv);
>  	INIT_WORK(&priv->multicast_work, lan865x_multicast_work_handler);
>  
> +	netdev->netdev_ops = &lan865x_netdev_ops;
> +
>  	priv->tc6 = oa_tc6_init(spi, netdev, NULL);
>  	if (!priv->tc6) {
>  		ret = -ENODEV;
> @@ -397,7 +399,6 @@ static int lan865x_probe(struct spi_device *spi)
>  
>  	netdev->if_port = IF_PORT_10BASET;
>  	netdev->irq = spi->irq;
> -	netdev->netdev_ops = &lan865x_netdev_ops;
>  	netdev->ethtool_ops = &lan865x_ethtool_ops;
>  
>  	ret = register_netdev(netdev);

Re: [PATCH net 01/10] net: hisilicon: hisi_femac: Move setting of netops to fix crash

[Jijie Shao]

on 2026/10/8 10:26, David Yang wrote:
> hisi_femac_drv_probe() connects the PHY before dev->netdev_ops is
> assigned. phy_attach_direct() -> phy_link_topo_add_phy() reads
> dev->netdev_ops through netdev_need_ops_lock() since the commit in
> question, so probing crashes with a NULL pointer dereference when
> CONFIG_NET_SHAPER is enabled.
>
>    phy_link_topo_add_phy from phy_attach_direct+0xec/0x37c
>    of_phy_get_and_connect from hisi_femac_drv_probe+0x1f4/0x558
>    Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
>
> Assign netdev_ops before the PHY attach, as was done for emac in commit
> 7c9f391ec89c ("net: emac: move setting of netops to fix crash").
>
> Fixes: ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev() locking assertion")
> Signed-off-by: David Yang <mmyangfl@gmail.com>

Reviewed-by: Jijie Shao <shaojijie@huawei.com>

If possible, modify this file as well. I have observed similar issues on the hibmcge driver recently:
drivers/net/ethernet/hisilicon/hibmcge/hbg_main.c

There are similar issues:
The driver assigns netdev_ops after hbg_init(), but hbg_init() calls
hbg_mdio_init() -> hbg_phy_connect() -> phy_connect_direct() ->
phy_attach_direct() -> phy_link_topo_add_phy(), which invokes
netdev_need_ops_lock(). With CONFIG_NET_SHAPER enabled, this function
dereferences dev->netdev_ops->net_shaper_ops. Since netdev_ops is still
NULL at this point, a NULL pointer dereference occurs.

Move the netdev_ops assignment before hbg_init() so that
netdev_need_ops_lock() can safely access netdev_ops during PHY
attachment.

Thanks,
Jijie Shao

> ---
>   drivers/net/ethernet/hisilicon/hisi_femac.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/hisilicon/hisi_femac.c b/drivers/net/ethernet/hisilicon/hisi_femac.c
> index d244a40df430..016605e86f0b 100644
> --- a/drivers/net/ethernet/hisilicon/hisi_femac.c
> +++ b/drivers/net/ethernet/hisilicon/hisi_femac.c
> @@ -830,6 +830,8 @@ static int hisi_femac_drv_probe(struct platform_device *pdev)
>   		hisi_femac_phy_reset(priv);
>   	}
>   
> +	ndev->netdev_ops = &hisi_femac_netdev_ops;
> +
>   	phy = of_phy_get_and_connect(ndev, node, hisi_femac_adjust_link);
>   	if (!phy) {
>   		dev_err(dev, "connect to PHY failed!\n");
> @@ -850,7 +852,6 @@ static int hisi_femac_drv_probe(struct platform_device *pdev)
>   
>   	ndev->watchdog_timeo = 6 * HZ;
>   	ndev->priv_flags |= IFF_UNICAST_FLT;
> -	ndev->netdev_ops = &hisi_femac_netdev_ops;
>   	ndev->ethtool_ops = &hisi_femac_ethtools_ops;
>   	netif_napi_add_weight(ndev, &priv->napi, hisi_femac_poll,
>   			      FEMAC_POLL_WEIGHT);

Re: [PATCH net 00/10] net: Move setting of netops to fix crash

[Jijie Shao]

on 2026/10/8 10:26, David Yang wrote:
> Commit ded86da4bbb7 ("net: ethtool: relax ethnl_req_get_phydev()
> locking assertion") put a netdev_need_ops_lock() check on the
> phy_attach_direct() path, in phy_link_topo_add_phy(). With
> CONFIG_NET_SHAPER enabled netdev_need_ops_lock() reads
> dev->netdev_ops->net_shaper_ops, so any driver that connects a PHY
> before assigning ndev->netdev_ops now dies with a NULL pointer
> dereference at probe time. The breakage showed up in v7.3-rc1.
>
> ibm/emac was hit first and fixed by commit 7c9f391ec89c ("net: emac:
> move setting of netops to fix crash"). These ten patches apply the
> same one-line move to the remaining in-tree drivers whose probe path
> attaches a PHY before filling in netdev_ops:
>
>    1. hisilicon/hisi_femac   (crash reproduced on hardware)
>    2. hisilicon/hip04
>    3. actions/owl-emac
>    4. adi/adin1140
>    5. marvell/mv643xx_eth
>    6. amd/au1000_eth
>    7. ethoc
>    8. aeroflex/greth
>    9. ti/icssm-prueth
>   10. microchip/lan865x      (attach happens inside oa_tc6_init())
>
> Only patch 1 was reproduced and verified on hardware; patches 2-10
> were found by source inspection and are neither build nor boot
> tested.
>
> Note that ti/netcp_ethss and cavium/thunder_bgx attach a PHY to
> netdevs that never get a netdev_ops at all (dummy netdevs), so they
> cannot be fixed by reordering and are not addressed here.
>
> David Yang (10):
>    net: hisilicon: hisi_femac: Move setting of netops to fix crash
>    net: hisilicon: hip04_eth: Move setting of netops to fix crash
>    net: ethernet: actions: Move setting of netops to fix crash
>    net: ethernet: adi: Move setting of netops to fix crash
>    net: mv643xx: move setting of netops to fix crash
>    net: au1000: move setting of netops to fix crash
>    net: ethoc: move setting of netops to fix crash
>    net: ethernet: aeroflex: move setting of netops to fix crash
>    net: ti: icssm-prueth: Move setting of netops to fix crash
>    microchip: lan865x: move setting of netops to fix crash

Why isn't the subject of the last patch "net: microchip: lan865x..."
But overall, it's okay.

Reviewed-by: Jijie Shao <shaojijie@huawei.com>


>
>   drivers/net/ethernet/actions/owl-emac.c          | 3 ++-
>   drivers/net/ethernet/adi/adin1140.c              | 3 ++-
>   drivers/net/ethernet/aeroflex/greth.c            | 3 ++-
>   drivers/net/ethernet/amd/au1000_eth.c            | 3 ++-
>   drivers/net/ethernet/ethoc.c                     | 3 ++-
>   drivers/net/ethernet/hisilicon/hip04_eth.c       | 3 ++-
>   drivers/net/ethernet/hisilicon/hisi_femac.c      | 3 ++-
>   drivers/net/ethernet/marvell/mv643xx_eth.c       | 4 ++--
>   drivers/net/ethernet/microchip/lan865x/lan865x.c | 3 ++-
>   drivers/net/ethernet/ti/icssm/icssm_prueth.c     | 3 ++-
>   10 files changed, 20 insertions(+), 11 deletions(-)
>