This is a note to let you know that I've just added the patch titled net: phy: Fix PHY unbind crash to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-phy-fix-phy-unbind-crash.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 7b9a88a390dacb37b051a7b09b9a08f546edf5eb Mon Sep 17 00:00:00 2001 From: Florian Fainelli <f.fainelli@xxxxxxxxx> Date: Fri, 17 Feb 2017 16:07:33 -0800 Subject: net: phy: Fix PHY unbind crash From: Florian Fainelli <f.fainelli@xxxxxxxxx> commit 7b9a88a390dacb37b051a7b09b9a08f546edf5eb upstream. The PHY library does not deal very well with bind and unbind events. The first thing we would see is that we were not properly canceling the PHY state machine workqueue, so we would be crashing while dereferencing phydev->drv since there is no driver attached anymore. Suggested-by: Russell King <rmk+kernel@xxxxxxxxxxxxxxx> Signed-off-by: Florian Fainelli <f.fainelli@xxxxxxxxx> Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx> Cc: Guenter Roeck <linux@xxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/phy/phy_device.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1714,6 +1714,8 @@ static int phy_remove(struct device *dev { struct phy_device *phydev = to_phy_device(dev); + cancel_delayed_work_sync(&phydev->state_queue); + mutex_lock(&phydev->lock); phydev->state = PHY_DOWN; mutex_unlock(&phydev->lock); Patches currently in stable-queue which might be from f.fainelli@xxxxxxxxx are queue-4.9/net-phy-dp83867-fix-irq-generation.patch queue-4.9/net-phy-fix-phy-unbind-crash.patch queue-4.9/net-dsa-b53-add-missing-arl-entries-for-bcm53125.patch queue-4.9/net-phy-correctly-process-phy_halted-in-phy_stop_machine.patch queue-4.9/phy-state-machine-failsafe-leave-invalid-running-state.patch