[PATCH net-next v2] net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

[PATCH net-next v2] net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

[Arun Iyengar via B4 Relay]

From: Arun Iyengar <aiyengar1990@gmail.com>

If mdio_mux_init() fails after the scan of the internal bus has powered
the internal PHY (the external bus returns -EPROBE_DEFER, or an
allocation fails), the dwmac_mux error path puts rst_ephy and ephy_clk
and then calls stmmac_pltfr_remove(). sun8i_dwmac_exit() then unpowers
the PHY through the clock and reset control that were just released.

Unpower the internal PHY before releasing them, as sun8i_dwmac_remove()
does.

Fixes: 529254216773 ("net: stmmac: dwmac-sun8i: Balance internal PHY resource references")
Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
---
Sashiko's review of another dwmac-sun8i series of mine pointed this
out. Build-tested only (arm64 and arm, W=1): I have no board with the
internal PHY (H3, H5 or V3s), so the error path was not exercised.

This patch was developed with Claude (Anthropic), which checked the
report against the code and wrote the fix and the commit message. I
reviewed it.
---
Changes in v2:
- Target net-next instead of net, drop Cc: stable (Andrew Lunn)
- Shorter commit message
- Rebased onto net-next
- Link to v1: https://patch.msgid.link/20261112-sun8i-emac-mux-uaf-v1-1-308ae7e6fcf2@gmail.com
---
 drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
index 2ece7ba9dd73..898560e8e95c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.c
@@ -1245,6 +1245,7 @@ static int sun8i_dwmac_probe(struct platform_device *pdev)
 	return 0;
 
 dwmac_mux:
+	sun8i_dwmac_unpower_internal_phy(gmac);
 	reset_control_put(gmac->rst_ephy);
 	clk_put(gmac->ephy_clk);
 dwmac_remove:

---
base-commit: 573af801552999954caa8347e4490b04cf4763f0
change-id: 20261112-sun8i-emac-mux-uaf-1ba885219fee

Best regards,
--  
Arun Iyengar <aiyengar1990@gmail.com>

Re: [PATCH net-next v2] net: stmmac: dwmac-sun8i: Fix use-after-free in the MDIO mux error path

[Andrew Lunn]

On Fri, Nov 13, 2026 at 07:55:00AM +0000, Arun Iyengar via B4 Relay wrote:
> From: Arun Iyengar <aiyengar1990@gmail.com>
> 
> If mdio_mux_init() fails after the scan of the internal bus has powered
> the internal PHY (the external bus returns -EPROBE_DEFER, or an
> allocation fails), the dwmac_mux error path puts rst_ephy and ephy_clk
> and then calls stmmac_pltfr_remove(). sun8i_dwmac_exit() then unpowers
> the PHY through the clock and reset control that were just released.
> 
> Unpower the internal PHY before releasing them, as sun8i_dwmac_remove()
> does.
> 
> Fixes: 529254216773 ("net: stmmac: dwmac-sun8i: Balance internal PHY resource references")
> Signed-off-by: Arun Iyengar <aiyengar1990@gmail.com>
> ---
> Sashiko's review of another dwmac-sun8i series of mine pointed this
> out. Build-tested only (arm64 and arm, W=1): I have no board with the
> internal PHY (H3, H5 or V3s), so the error path was not exercised.
> 
> This patch was developed with Claude (Anthropic), which checked the
> report against the code and wrote the fix and the commit message. I
> reviewed it.
> ---
> Changes in v2:
> - Target net-next instead of net, drop Cc: stable (Andrew Lunn)

Maybe i was not explicitly, sorry. If it is for net-next, it should
not have a Fixes: tag.

	Andrew