[PATCH RFC v2] net: phy: fix suspicious RCU usage in phy_detach()

[syzbot]

During device probe (for example, in ax88772_bind()), drivers may invoke
phylink_connect_phy() before the net_device is registered (while
dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
If connecting or bringing up the PHY fails inside phylink_connect_phy(),
the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
usage warning:

WARNING: suspicious RCU usage
drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
usage!

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
</TASK>

Fix this by using rcu_dereference_protected() in phy_detach() with a
condition checking whether the RTNL lock is held or dev->reg_state ==
NETREG_UNINITIALIZED. This allows safe cleanup on probe failure before
device registration without requiring drivers to acquire the RTNL lock.

Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
Assisted-by: Gemini:gemini-3.7-flash syzbot
Reported-by: syzbot+694b49...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7
Link: https://syzkaller.appspot.com/ai_job?id=360ce09e-643b-4b98-9061-0d730f847be9
To: "Andrew Lunn" <and...@lunn.ch>
To: "David S. Miller" <da...@davemloft.net>
To: "Eric Dumazet" <edum...@google.com>
To: "Heiner Kallweit" <hkall...@gmail.com>
To: "Jakub Kicinski" <ku...@kernel.org>
To: <net...@vger.kernel.org>
To: "Paolo Abeni" <pab...@redhat.com>
To: "Kory Maincent" <kory.m...@bootlin.com>
Cc: <linux-...@vger.kernel.org>
Cc: "Russell King" <li...@armlinux.org.uk>

---
v2:
- Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
- Updated the commit subject and description to reflect the changes in phylib.

v1:
https://lore.kernel.org/all/2835933a-117e-405a...@mail.kernel.org/T/
---
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 94b2e85e0..50c7a060b 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
struct hwtstamp_provider *hwprov;

/* hwprov may technically be protected by ops lock but
- * not for devices with a phydev, see phy_link_topo_add_phy()
+ * not for devices with a phydev, see phy_link_topo_add_phy().
+ * RTNL is not held when cleaning up on probe failure before
+ * device registration.
*/
- hwprov = rtnl_dereference(dev->hwprov);
+ hwprov = rcu_dereference_protected(dev->hwprov,
+ lockdep_rtnl_is_held() ||
+ dev->reg_state == NETREG_UNINITIALIZED);
/* Disable timestamp if it is the one selected */
if (hwprov && hwprov->phydev == phydev) {
rcu_assign_pointer(dev->hwprov, NULL);


base-commit: df2908090cda368b01ff43709f51890076c56157
--
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzk...@googlegroups.com.

[Aleksandr Nogikh]

should that be `dev->reg_state != NETREG_REGISTERED`?

[syzbot]

During device probe (for example, in ax88772_bind()), drivers may invoke
phylink_connect_phy() before the net_device is registered (while
dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
If connecting or bringing up the PHY fails inside phylink_connect_phy(),
the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
usage warning:

WARNING: suspicious RCU usage
drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
usage!

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
</TASK>

Fix this by using rcu_dereference_protected() in phy_detach() with a

condition checking whether the RTNL lock is held or dev->reg_state !=
NETREG_REGISTERED. This allows safe cleanup on probe failure before device

registration without requiring drivers to acquire the RTNL lock.

Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")
Assisted-by: Gemini:gemini-3.7-flash syzbot
Reported-by: syzbot+694b49...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7

Link: https://syzkaller.appspot.com/ai_job?id=63daf6f3-5d22-4261-b346-dfd3a5537965

To: "Andrew Lunn" <and...@lunn.ch>
To: "David S. Miller" <da...@davemloft.net>
To: "Eric Dumazet" <edum...@google.com>
To: "Heiner Kallweit" <hkall...@gmail.com>
To: "Jakub Kicinski" <ku...@kernel.org>
To: <net...@vger.kernel.org>
To: "Paolo Abeni" <pab...@redhat.com>
To: "Kory Maincent" <kory.m...@bootlin.com>
Cc: <linux-...@vger.kernel.org>
Cc: "Russell King" <li...@armlinux.org.uk>

---

v3:
- Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().

v2:
- Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
- Updated the commit subject and description to reflect the changes in phylib.

https://lore.kernel.org/all/5a7201b1-c826-4855...@mail.kernel.org/T/

v1:
https://lore.kernel.org/all/2835933a-117e-405a...@mail.kernel.org/T/
---
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c

index 94b2e85e0..ac09943e1 100644

--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
struct hwtstamp_provider *hwprov;

/* hwprov may technically be protected by ops lock but
- * not for devices with a phydev, see phy_link_topo_add_phy()
+ * not for devices with a phydev, see phy_link_topo_add_phy().
+ * RTNL is not held when cleaning up on probe failure before
+ * device registration.
*/
- hwprov = rtnl_dereference(dev->hwprov);
+ hwprov = rcu_dereference_protected(dev->hwprov,
+ lockdep_rtnl_is_held() ||

+ dev->reg_state != NETREG_REGISTERED);

[Aleksandr Nogikh]

On Tue, Sep 8, 2026 at 2:38 PM syzbot <syz...@kernel.org> wrote:
>
> During device probe (for example, in ax88772_bind()), drivers may invoke
> phylink_connect_phy() before the net_device is registered (while
> dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.
> If connecting or bringing up the PHY fails inside phylink_connect_phy(),
> the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
> is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
> held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
> usage warning:

Update the description to be more understandable

[syzbot]

During device probe (for example, in ax88772_bind()), drivers may invoke
phylink_connect_phy() before the net_device is registered (while
dev->reg_state is NETREG_UNINITIALIZED) and without holding the RTNL lock.

If connecting or bringing up the PHY fails inside phylink_connect_phy(),
the error cleanup path invokes phy_detach(). In phy_detach(), dev->hwprov
is dereferenced using rtnl_dereference(), which expects the RTNL lock to be
held. Because the RTNL lock is not held, lockdep triggers a suspicious RCU
usage warning:

WARNING: suspicious RCU usage
drivers/net/phy/phy_device.c:1944 suspicious rcu_dereference_protected()
usage!

Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
lockdep_rcu_suspicious+0x140/0x1d0 kernel/locking/lockdep.c:6972
phy_detach+0x219/0x550 drivers/net/phy/phy_device.c:1944
phylink_connect_phy+0x1dc/0x300 drivers/net/phy/phylink.c:2251
ax88772_init_phy+0xe3/0x390 drivers/net/usb/asix_devices.c:714
ax88772_bind+0x9cb/0xe50 drivers/net/usb/asix_devices.c:925
usbnet_probe+0xab3/0x2ad0 drivers/net/usb/usbnet.c:1808
</TASK>

Before a net_device is registered (dev->reg_state != NETREG_REGISTERED), it
is not exposed to the rest of the network stack, so the probing context has
exclusive access and holding the RTNL lock is not required. Fix this by

using rcu_dereference_protected() in phy_detach() with a condition checking
whether the RTNL lock is held or dev->reg_state != NETREG_REGISTERED. This
allows safe cleanup on probe failure before device registration without
requiring drivers to acquire the RTNL lock.

Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice")

Assisted-by: Gemini:gemini-3.8-flash syzbot

Reported-by: syzbot+694b49...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=694b49f41098a5df4fd7

Link: https://syzkaller.appspot.com/ai_job?id=92beb335-2c44-4286-b46c-a3ab5fe10b00

To: "Andrew Lunn" <and...@lunn.ch>
To: "David S. Miller" <da...@davemloft.net>
To: "Eric Dumazet" <edum...@google.com>
To: "Heiner Kallweit" <hkall...@gmail.com>
To: "Jakub Kicinski" <ku...@kernel.org>
To: <net...@vger.kernel.org>
To: "Paolo Abeni" <pab...@redhat.com>
To: "Kory Maincent" <kory.m...@bootlin.com>
Cc: <linux-...@vger.kernel.org>
Cc: "Russell King" <li...@armlinux.org.uk>

---

v4:
- Clarify in the commit description why dereferencing dev->hwprov without RTNL is safe before device registration.

v3:
- Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().

https://lore.kernel.org/all/5e1c820e-982c-4c4b...@mail.kernel.org/T/

[Marco Elver]

On Tue, 8 Sept 2026 at 17:04, 'syzbot' via
syzkaller-upstream-moderation

This should use READ_ONCE() or use the helper dev_isalive() if that is
returning the appropriate boolean. The helper dev_isalive() also has
some commentary regarding locking requirements.

> /* Disable timestamp if it is the one selected */
> if (hwprov && hwprov->phydev == phydev) {
> rcu_assign_pointer(dev->hwprov, NULL);
>
>
> base-commit: df2908090cda368b01ff43709f51890076c56157
> --
> This is an AI-generated patch subject to moderation.
> Reply with '#syz upstream' to Sign-off the patch as a human author
> and send it to the upstream kernel mailing lists.
> Reply with '#syz reject' to reject it ('#syz unreject' to undo).
>
> See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
> You can comment on the patch as usual, syzbot will try to address
> the comments and send a new version of the patch if necessary.
> syzbot engineers can be reached at syzk...@googlegroups.com.
>

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/cc8448ce-5426-472c-b0f4-84f9237eb50f%40mail.kernel.org.

[syzbot]

Link: https://syzkaller.appspot.com/ai_job?id=03f9ee28-d9b3-48a4-8d9a-3878018387f0

To: "Andrew Lunn" <and...@lunn.ch>
To: "David S. Miller" <da...@davemloft.net>
To: "Eric Dumazet" <edum...@google.com>
To: "Heiner Kallweit" <hkall...@gmail.com>
To: "Jakub Kicinski" <ku...@kernel.org>
To: <net...@vger.kernel.org>
To: "Paolo Abeni" <pab...@redhat.com>
To: "Kory Maincent" <kory.m...@bootlin.com>
Cc: <linux-...@vger.kernel.org>
Cc: "Russell King" <li...@armlinux.org.uk>

---

v5:
- Use READ_ONCE() to read dev->reg_state.

v4:
- Clarify in the commit description why dereferencing dev->hwprov without RTNL is safe before device registration.

https://lore.kernel.org/all/cc8448ce-5426-472c...@mail.kernel.org/T/

v3:
- Check dev->reg_state != NETREG_REGISTERED instead of dev->reg_state == NETREG_UNINITIALIZED in phy_detach().
https://lore.kernel.org/all/5e1c820e-982c-4c4b...@mail.kernel.org/T/

v2:
- Moved the fix to phy_detach() in phylib by allowing rcu_dereference_protected() when dev->reg_state is NETREG_UNINITIALIZED, instead of acquiring RTNL in asix.
- Updated the commit subject and description to reflect the changes in phylib.
https://lore.kernel.org/all/5a7201b1-c826-4855...@mail.kernel.org/T/

v1:
https://lore.kernel.org/all/2835933a-117e-405a...@mail.kernel.org/T/
---
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c

index 94b2e85e0..2f0a10739 100644

--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1939,9 +1939,13 @@ void phy_detach(struct phy_device *phydev)
struct hwtstamp_provider *hwprov;

/* hwprov may technically be protected by ops lock but
- * not for devices with a phydev, see phy_link_topo_add_phy()
+ * not for devices with a phydev, see phy_link_topo_add_phy().
+ * RTNL is not held when cleaning up on probe failure before
+ * device registration.
*/
- hwprov = rtnl_dereference(dev->hwprov);
+ hwprov = rcu_dereference_protected(dev->hwprov,
+ lockdep_rtnl_is_held() ||

+ READ_ONCE(dev->reg_state) != NETREG_REGISTERED);