Re: [PATCH net v1] net: phy: fix NULL deref in IRQ handler after unbind

Hi Andrew,

在 2026/8/24 20:54, Andrew Lunn 写道:

>> The IRQ is requested at attach time and released by phy_disconnect(),
>> so phy_remove() cannot free it without a later double-free.
> So this sounds wrong.
>
> If you unbind the PHY, you need to also unbind the MAC, since a MAC
> without a PHY is useless. When the MAC unloads, it will call
> phy_remove() so everything unwinds in the correct order.
>
>      Andrew
>
> ---
> pw-bot: cr
> 	

I agree that the MAC should normally be unbound before the PHY.

Also, the paragraph about freeing the IRQ in phy_remove() was
misleading. It was not relevant to the change being proposed,
so I will drop it in v2.

Do you mean that unbinding the PHY first through sysfs is not a
supported operation?

The same sequence was used to reproduce the issue fixed by commit
c2b727df7caa ("net: phy: Avoid NPD upon phy_detach() when driver is
unbound"), which made me think that it should at least not crash:

https://lore.kernel.org/all/[email protected]/

If this ordering is required, would the right fix be to enforce it
instead?

Thanks,
Xuanqiang