Patch "net: phy: prevent stale pointer dereference in phy_init()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: phy: prevent stale pointer dereference in phy_init()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-phy-prevent-stale-pointer-dereference-in-phy_ini.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 2a9973bb55fd9bdd01399a399a2f85f45da84b70
Author: Vladimir Oltean <vladimir.oltean@xxxxxxx>
Date:   Thu Jul 20 03:02:31 2023 +0300

    net: phy: prevent stale pointer dereference in phy_init()
    
    [ Upstream commit 1c613beaf877c0c0d755853dc62687e2013e55c4 ]
    
    mdio_bus_init() and phy_driver_register() both have error paths, and if
    those are ever hit, ethtool will have a stale pointer to the
    phy_ethtool_phy_ops stub structure, which references memory from a
    module that failed to load (phylib).
    
    It is probably hard to force an error in this code path even manually,
    but the error teardown path of phy_init() should be the same as
    phy_exit(), which is now simply not the case.
    
    Fixes: 55d8f053ce1b ("net: phy: Register ethtool PHY operations")
    Link: https://lore.kernel.org/netdev/ZLaiJ4G6TaJYGJyU@xxxxxxxxxxxxxxxxxxxxx/
    Suggested-by: Russell King (Oracle) <linux@xxxxxxxxxxxxxxx>
    Signed-off-by: Vladimir Oltean <vladimir.oltean@xxxxxxx>
    Link: https://lore.kernel.org/r/20230720000231.1939689-1-vladimir.oltean@xxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 73485383db4ef..6085a28cae3d2 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -3253,23 +3253,30 @@ static int __init phy_init(void)
 {
 	int rc;
 
+	ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
+
 	rc = mdio_bus_init();
 	if (rc)
-		return rc;
+		goto err_ethtool_phy_ops;
 
-	ethtool_set_ethtool_phy_ops(&phy_ethtool_phy_ops);
 	features_init();
 
 	rc = phy_driver_register(&genphy_c45_driver, THIS_MODULE);
 	if (rc)
-		goto err_c45;
+		goto err_mdio_bus;
 
 	rc = phy_driver_register(&genphy_driver, THIS_MODULE);
-	if (rc) {
-		phy_driver_unregister(&genphy_c45_driver);
+	if (rc)
+		goto err_c45;
+
+	return 0;
+
 err_c45:
-		mdio_bus_exit();
-	}
+	phy_driver_unregister(&genphy_c45_driver);
+err_mdio_bus:
+	mdio_bus_exit();
+err_ethtool_phy_ops:
+	ethtool_set_ethtool_phy_ops(NULL);
 
 	return rc;
 }