[BUG] _phy_state_machine / phy_stop -- a USB PHY that reports an MDIO error to phylib panics a panic_on_warn kernel

[BUG] _phy_state_machine / phy_stop -- a USB PHY that reports an MDIO error to phylib panics a panic_on_warn kernel

[Farhad Alemi]

Hello,

As part of the kernel research at ASU's SEFCOM
lab, we hit the crash below. Crash reports can be found here:

  https://github.com/farhad-alemi/public_bug_reports/tree/main/146-phylib-phy_error-warn_on-mdio-error/

  smsc95xx 6-1:1.0 eth0: Error reading MII_ACCESS
  smsc95xx 6-1:1.0 eth0: smsc95xx_mdio_read: MII is busy
  _phy_start_aneg+0x0/0x480: returned: -32
  WARNING: drivers/net/phy/phy.c:1352 at phy_error_precise
drivers/net/phy/phy.c:1352 [inline], CPU#0: kworker/0:3/5063
  WARNING: drivers/net/phy/phy.c:1352 at
_phy_state_machine+0x667/0xf20 drivers/net/phy/phy.c:1613, CPU#0:
kworker/0:3/5063
  Modules linked in:
  CPU: 0 UID: 0 PID: 5063 Comm: kworker/0:3 Not tainted 7.1.0-rc5 #1
PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
  Workqueue: events_power_efficient phy_state_machine
  RIP: 0010:phy_error_precise drivers/net/phy/phy.c:1352 [inline]
  RIP: 0010:_phy_state_machine+0x66d/0xf20 drivers/net/phy/phy.c:1613
  Call Trace:
   <TASK>
   phy_state_machine+0x2b/0x70 drivers/net/phy/phy.c:1652
   process_one_work kernel/workqueue.c:3314 [inline]
   process_scheduled_works+0x881/0x1170 kernel/workqueue.c:3397
   worker_thread+0x988/0xde0 kernel/workqueue.c:3478
   kthread+0x333/0x420 kernel/kthread.c:436
   ret_from_fork+0x351/0x940 arch/x86/kernel/process.c:158
   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
   </TASK>

Our reproducer.c is available upon request.

Happy to test a patch if that would help.

Regards,

Re: [BUG] _phy_state_machine / phy_stop -- a USB PHY that reports an MDIO error to phylib panics a panic_on_warn kernel

[Andrew Lunn]

On Thu, Aug 27, 2026 at 10:29:36PM -0700, Farhad Alemi wrote:
> Hello,
> 
> As part of the kernel research at ASU's SEFCOM
> lab, we hit the crash below. Crash reports can be found here:
> 
>   https://github.com/farhad-alemi/public_bug_reports/tree/main/146-phylib-phy_error-warn_on-mdio-error/
> 
>   smsc95xx 6-1:1.0 eth0: Error reading MII_ACCESS
>   smsc95xx 6-1:1.0 eth0: smsc95xx_mdio_read: MII is busy
>   _phy_start_aneg+0x0/0x480: returned: -32
>   WARNING: drivers/net/phy/phy.c:1352 at phy_error_precise
> drivers/net/phy/phy.c:1352 [inline], CPU#0: kworker/0:3/5063
>   WARNING: drivers/net/phy/phy.c:1352 at
> _phy_state_machine+0x667/0xf20 drivers/net/phy/phy.c:1613, CPU#0:
> kworker/0:3/5063
>   Modules linked in:
>   CPU: 0 UID: 0 PID: 5063 Comm: kworker/0:3 Not tainted 7.1.0-rc5 #1
> PREEMPT(full)
>   Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
> 1.16.3-debian-1.16.3-2 04/01/2014
>   Workqueue: events_power_efficient phy_state_machine
>   RIP: 0010:phy_error_precise drivers/net/phy/phy.c:1352 [inline]
>   RIP: 0010:_phy_state_machine+0x66d/0xf20 drivers/net/phy/phy.c:1613
>   Call Trace:
>    <TASK>
>    phy_state_machine+0x2b/0x70 drivers/net/phy/phy.c:1652
>    process_one_work kernel/workqueue.c:3314 [inline]
>    process_scheduled_works+0x881/0x1170 kernel/workqueue.c:3397
>    worker_thread+0x988/0xde0 kernel/workqueue.c:3478
>    kthread+0x333/0x420 kernel/kthread.c:436
>    ret_from_fork+0x351/0x940 arch/x86/kernel/process.c:158
>    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>    </TASK>

Could you point out the crash here? I don't see a crash.

      Andrew