In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: phylink: record the PHY only once bringup cannot fail<\/p>\n
phylink_bringup_phy() stores the PHY in pl->phydev before its last
\nfallible step: on a MAC whose phylink ops implement LPI,
\nphy_eee_rx_clock_stop() can fail with a real MDIO error. The callers
\nunwind with phy_detach(), which knows nothing about pl->phydev, so a
\npointer to a PHY that is no longer attached outlives the failed
\nconnect.<\/p>\n
What that costs depends on how the caller got here.
\nphylink_connect_phy() goes through phylink_attach_phy(), which refuses
\nto attach while pl->phydev is set, turning a transient MDIO error into
\na permanent -EBUSY. The SFP path is worse than that: sfp_sm_probe_phy()
\nanswers the failure with phy_device_remove() and phy_device_free(), and
\nit assigns sfp->mod_phy only past that error return, so nothing clears
\npl->phydev and it is left pointing at a freed phy_device that
\nphylink_resolve() and the ethtool helpers go on reading.
\nphylink_fwnode_phy_connect() has no such check, so a later connect
\noverwrites the stale pointer and hides the problem. A disconnect does
\nnot: phylink_disconnect_phy() hands that pointer to phy_disconnect(),
\nand the second phy_detach() on the same PHY drops references the first
\none already released.<\/p>\n
Found while making a DSA port survive a PHY whose driver arrives after
\nthe switch probes: keeping the port across a failed connect and
\nretrying is what makes this window reachable.<\/p>\n
Publish the pointer after the last call that can fail instead of
\nunwinding it afterwards. Nothing between the two points reads
\npl->phydev, and the registration that follows cannot fail:
\nphy_request_interrupt() falls back to polling on its own. The PHY-side
\nstate keeps the order it had, so no MDIO operation moves relative to
\nanother.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: phylink: record the PHY only once bringup cannot fail<\/p>\n
phylink_bringup_phy() stores the PHY in pl->phydev before its last
\nfall<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41035","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41035","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41035"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41035"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41035"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}