From nobody Sun May 24 20:37:40 2026 Received: from mail-yx1-f51.google.com (mail-yx1-f51.google.com [74.125.224.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4488337EFFF for ; Thu, 21 May 2026 17:02:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.224.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779382970; cv=none; b=Me04e26HUir36uQevUcApN5smiFoIFofZI+9+675zXrND1j3n+aTjs2M6r8kykK7kSs9SBGl2CGXakBTRgayCVSWzXcqmSLNzb7ufVOYZoLoqufp2IxvPfmn+CBfL+g4fZGmWrUfWz3HYIms0qJ5NJWobrJUwQXnDNosUSBwAwY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779382970; c=relaxed/simple; bh=zx9iqLN9zmh++r23XiPtByTx7CLtzJ7HqXlS3Lo3u7M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=lFEvr1/X2bd7XOVH80e5YecT3GxAxdZmYLm9w8oX/AXXQUmYgQ0fsnrZlHlLjrwJ6dZGcY3uNZdRSguEx0op06NahugCQYkqehBgSZjdE+Jn6Qz1mPLlyI/VFKLY4GCg4Yplw8MY6I7n9pydtagjMepDIcoW8G6bzvMj7uHVJqU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=U6r1l/l/; arc=none smtp.client-ip=74.125.224.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="U6r1l/l/" Received: by mail-yx1-f51.google.com with SMTP id 956f58d0204a3-651c366f7efso6742491d50.1 for ; Thu, 21 May 2026 10:02:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779382967; x=1779987767; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=0B8qDAE2Hi4K54lFJwvYiq6K8A1ngqWVMdmiVrD5B7k=; b=U6r1l/l/pgu0L3g+Isqnd1Wati3cftc6RKz2p2YiVi/e06muplMRMg/8/Wgvh4CF8b 5A5pBOs6awqO01v2bIg2pTL1nVFIuw5oC9tPPuKwPHsj2MGINawcbFvuXJuDGJds09Zl J3VAmGPK/ywgAxq8448ZArgh0YSPVoMCtijk8RFJtSfSqTqqFWvp+Cfs35V/ALRWBivr hp/H8TC33s40sBlG7KmmxMqjJXTAUtHNSfaQGRNkEzsg8xW7UhtV3wXRk3CtNBVz3XUZ JkiBGdzIqUZj8J+l2dDNxrK8B8wJuMDDljZBRO/rB6oCXhSXTGvJGN0OIFsESHP+wAyp lQMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779382967; x=1779987767; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=0B8qDAE2Hi4K54lFJwvYiq6K8A1ngqWVMdmiVrD5B7k=; b=JP1A4D9ZtpKWOdOM4AUbBCP8CsKbFwLa/s83H60y8v6pVtWwgGTuNAQrrLc33RAQ/S xOen/+myt01GHLKUQZpxAIA8gcN4ctWLdR4IFchbjR/u+r8MdG8WNtA+gFRpg75Wk4at gyCWrnOIkLhU2Qv1NgUarREfkyqgovd/TKWlzh2nofwJWwKo1MJ9R0cT7wSGP5rkagYR liYfBBkbvp8Fe5BbD1M2XPuIzwzIUIGjmGyJPus1GxaQ5MBI1PtYKFHy7374KlV7HtYZ hpLf43bzk+ORQQhhiH94ZH2bPTsLJO8lkNPXRo0/2rmgimT6NaQxuydEmZFcnlSWFxez XBvA== X-Forwarded-Encrypted: i=1; AFNElJ/IQGVaS3B73dHvYrV/uMMH5nHgXP0bCjGzuyNHY/p1F+S5CUSjJyShYWH+GAQ2u3iq0OntUYVNKHcwAi4=@vger.kernel.org X-Gm-Message-State: AOJu0Ywj2uohwgPoX/bDH1x546NQGt0WNUScbjDBBzIVlYpR03O8l4LO /HfczO5dqtiF0EdP4+4oU99M8/uwExYbxo5kMhXr0QRpWvHssz+G9t5D X-Gm-Gg: Acq92OFyOFgSNIQANM3mgN10Ny4mnLowh0V8zWtAs1ATAh4djCSqoya1IhWIUdcd/MQ SNM8Ak3lC4z+LRNdlomGinnqkH8e8T06DpdVCPKw2/ZZxjycIrRFwPleKk++fr+BiRsqaukSjhQ 93S+uo2d/s58nUjSDJMr2jeZPLSWHaOsHC+4amIJjz62gUoERvEtykXlPEf9c4NVnaTFzvXq3ue YHd/HrLgerfcdQNZptc6QlAG3fUwAVuP+D7hcv4pwXU6GBz701aMu3BCPh6MWFINlwmH+4+uNx0 2YAIIah8yJbdtamOdfIjHMivJdkKqVFM0JKCWvmMor2Go1tcmGrVM/ceXeFSiZz3OsDlqAudmZn ybkpxP8uAQDvJZgWC0gPG50SqGazdKWpQu0sFwzOm2yjT995RX5TLdFRnriKEe73LlJL6M+p2Z7 phVkocUUdclivyJaUmbBVrMUuUvGME3w== X-Received: by 2002:a05:690e:440b:b0:65e:41a4:54ca with SMTP id 956f58d0204a3-65eae2b3fb9mr2406856d50.62.1779382966868; Thu, 21 May 2026 10:02:46 -0700 (PDT) Received: from localhost ([2a03:2880:ff:55::]) by smtp.gmail.com with ESMTPSA id 956f58d0204a3-65ec1eea6d3sm430363d50.13.2026.05.21.10.02.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 21 May 2026 10:02:46 -0700 (PDT) From: Bobby Eshleman Date: Thu, 21 May 2026 09:51:33 -0700 Subject: [PATCH net] eth: fbnic: move aui and fec from fbnic_net to fbnic_dev Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260521-fbnic-aui-change-v1-1-fc0c46e8e682@meta.com> X-B4-Tracking: v=1; b=H4sIABU4D2oC/y3MTQqAIBAG0KsM3zqh7I+8SrQwnWo2FloRRHcPo vWDdyNxFE4wdCPyKUnWAENFRnCLDTMr8TAEnesmr4tSTWMQp+wh6vdKW9dpb0vfVsgIW+RJrq/ sEXjH8DwvgxbgZWcAAAA= X-Change-ID: 20260513-fbnic-aui-change-42ac92da3d74 To: Alexander Duyck , Jakub Kicinski , kernel-team@meta.com, Andrew Lunn , "David S. Miller" , Eric Dumazet , Paolo Abeni , Russell King Cc: Mohsin Bashir , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Bobby Eshleman X-Mailer: b4 0.14.3 From: Bobby Eshleman fbnic_mdio_read_pmd() reaches through fbd->netdev to netdev_priv() in order to read fbn->aui: if (fbd->netdev) { fbn =3D netdev_priv(fbd->netdev); if (fbn->aui < FBNIC_AUI_UNKNOWN) aui =3D fbn->aui; } This can lead to a TOCTOU bug where fbd->netdev is checked after being freed but before being cleared. Both aui and fec describe the link configuration of the NIC, so move them to fbnic_dev together. The MDIO layer (and other fbd-level code) can read them directly without bouncing through fbd->netdev. The hazardous accesses through fbd->netdev are dropped. Fixes: d0ce9fd7eae0 ("fbnic: Add SW shim for MDIO interface to PMD and PCS") Suggested-by: Jakub Kicinski Reviewed-by: Alexander Duyck Signed-off-by: Bobby Eshleman --- drivers/net/ethernet/meta/fbnic/fbnic.h | 3 +++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 2 +- drivers/net/ethernet/meta/fbnic/fbnic_mac.c | 3 +-- drivers/net/ethernet/meta/fbnic/fbnic_mdio.c | 9 ++------- drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 3 --- drivers/net/ethernet/meta/fbnic/fbnic_phylink.c | 18 ++++++++++-------- 6 files changed, 17 insertions(+), 21 deletions(-) diff --git a/drivers/net/ethernet/meta/fbnic/fbnic.h b/drivers/net/ethernet= /meta/fbnic/fbnic.h index d0715695c43e..76cfaf77b5ef 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic.h +++ b/drivers/net/ethernet/meta/fbnic/fbnic.h @@ -88,6 +88,9 @@ struct fbnic_dev { unsigned long end_of_pmd_training; u8 pmd_state; =20 + u8 aui; + u8 fec; + /* Local copy of hardware statistics */ struct fbnic_hw_stats hw_stats; =20 diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_irq.c b/drivers/net/ethe= rnet/meta/fbnic/fbnic_irq.c index 5e383d40abc7..03dbb53b33d9 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_irq.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_irq.c @@ -132,7 +132,7 @@ static irqreturn_t fbnic_mac_msix_intr(int __always_unu= sed irq, void *data) fbn =3D netdev_priv(fbd->netdev); =20 /* Record link down events */ - if (!fbd->mac->get_link(fbd, fbn->aui, fbn->fec)) + if (!fbd->mac->get_link(fbd, fbd->aui, fbd->fec)) phylink_pcs_change(fbn->pcs, false); =20 return IRQ_HANDLED; diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_mac.c b/drivers/net/ethe= rnet/meta/fbnic/fbnic_mac.c index 53b7a938b4c2..e911dbf41b46 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_mac.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_mac.c @@ -515,7 +515,6 @@ static u32 __fbnic_mac_cmd_config_asic(struct fbnic_dev= *fbd, /* Enable MAC Promiscuous mode and Tx padding */ u32 command_config =3D FBNIC_MAC_COMMAND_CONFIG_TX_PAD_EN | FBNIC_MAC_COMMAND_CONFIG_PROMISC_EN; - struct fbnic_net *fbn =3D netdev_priv(fbd->netdev); =20 /* Disable pause frames if not enabled */ if (!tx_pause) @@ -524,7 +523,7 @@ static u32 __fbnic_mac_cmd_config_asic(struct fbnic_dev= *fbd, command_config |=3D FBNIC_MAC_COMMAND_CONFIG_RX_PAUSE_DIS; =20 /* Disable fault handling if no FEC is requested */ - if (fbn->fec =3D=3D FBNIC_FEC_OFF) + if (fbd->fec =3D=3D FBNIC_FEC_OFF) command_config |=3D FBNIC_MAC_COMMAND_CONFIG_FLT_HDL_DIS; =20 return command_config; diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c b/drivers/net/eth= ernet/meta/fbnic/fbnic_mdio.c index fe3a4ce88413..b571d4e3f36d 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c @@ -5,7 +5,6 @@ #include =20 #include "fbnic.h" -#include "fbnic_netdev.h" =20 /* fbnic MDIO Interface Layout * @@ -54,18 +53,14 @@ static int fbnic_mdio_read_pmd(struct fbnic_dev *fbd, int addr, int regnum) { u8 aui =3D FBNIC_AUI_UNKNOWN; - struct fbnic_net *fbn; int ret =3D 0; =20 /* We don't need a second PMD, just one can handle both lanes */ if (addr) return 0; =20 - if (fbd->netdev) { - fbn =3D netdev_priv(fbd->netdev); - if (fbn->aui < FBNIC_AUI_UNKNOWN) - aui =3D fbn->aui; - } + if (fbd->aui < FBNIC_AUI_UNKNOWN) + aui =3D fbd->aui; =20 switch (regnum) { case MDIO_PMA_RXDET: diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h b/drivers/net/e= thernet/meta/fbnic/fbnic_netdev.h index eded20b0e9e4..213253a818bb 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h +++ b/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h @@ -46,9 +46,6 @@ struct fbnic_net { struct phylink_config phylink_config; struct phylink_pcs *pcs; =20 - u8 aui; - u8 fec; - /* Cached top bits of the HW time counter for 40b -> 64b conversion */ u32 time_high; /* Protect readers of @time_offset, writers take @time_lock. */ diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c b/drivers/net/= ethernet/meta/fbnic/fbnic_phylink.c index 09c5225111be..61463bcb6431 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c @@ -65,6 +65,7 @@ int fbnic_phylink_ethtool_ksettings_get(struct net_device= *netdev, struct ethtool_link_ksettings *cmd) { struct fbnic_net *fbn =3D netdev_priv(netdev); + struct fbnic_dev *fbd =3D fbn->fbd; int err; =20 err =3D phylink_ethtool_ksettings_get(fbn->phylink, cmd); @@ -72,7 +73,7 @@ int fbnic_phylink_ethtool_ksettings_get(struct net_device= *netdev, unsigned long *supp =3D cmd->link_modes.supported; =20 cmd->base.port =3D PORT_DA; - cmd->lanes =3D (fbn->aui & FBNIC_AUI_MODE_R2) ? 2 : 1; + cmd->lanes =3D (fbd->aui & FBNIC_AUI_MODE_R2) ? 2 : 1; =20 fbnic_phylink_get_supported_fec_modes(supp); } @@ -84,11 +85,12 @@ int fbnic_phylink_get_fecparam(struct net_device *netde= v, struct ethtool_fecparam *fecparam) { struct fbnic_net *fbn =3D netdev_priv(netdev); + struct fbnic_dev *fbd =3D fbn->fbd; =20 - if (fbn->fec & FBNIC_FEC_RS) { + if (fbd->fec & FBNIC_FEC_RS) { fecparam->active_fec =3D ETHTOOL_FEC_RS; fecparam->fec =3D ETHTOOL_FEC_RS; - } else if (fbn->fec & FBNIC_FEC_BASER) { + } else if (fbd->fec & FBNIC_FEC_BASER) { fecparam->active_fec =3D ETHTOOL_FEC_BASER; fecparam->fec =3D ETHTOOL_FEC_BASER; } else { @@ -96,7 +98,7 @@ int fbnic_phylink_get_fecparam(struct net_device *netdev, fecparam->fec =3D ETHTOOL_FEC_OFF; } =20 - if (fbn->aui & FBNIC_AUI_MODE_PAM4) + if (fbd->aui & FBNIC_AUI_MODE_PAM4) fecparam->fec |=3D ETHTOOL_FEC_AUTO; =20 return 0; @@ -120,7 +122,7 @@ fbnic_phylink_mac_prepare(struct phylink_config *config= , unsigned int mode, struct fbnic_net *fbn =3D netdev_priv(netdev); struct fbnic_dev *fbd =3D fbn->fbd; =20 - fbd->mac->prepare(fbd, fbn->aui, fbn->fec); + fbd->mac->prepare(fbd, fbd->aui, fbd->fec); =20 return 0; } @@ -140,7 +142,7 @@ fbnic_phylink_mac_finish(struct phylink_config *config,= unsigned int mode, struct fbnic_dev *fbd =3D fbn->fbd; =20 /* Retest the link state and restart interrupts */ - fbd->mac->get_link(fbd, fbn->aui, fbn->fec); + fbd->mac->get_link(fbd, fbd->aui, fbd->fec); =20 return 0; } @@ -227,10 +229,10 @@ int fbnic_phylink_create(struct net_device *netdev) __set_bit(PHY_INTERFACE_MODE_25GBASER, fbn->phylink_config.supported_interfaces); =20 - fbnic_mac_get_fw_settings(fbd, &fbn->aui, &fbn->fec); + fbnic_mac_get_fw_settings(fbd, &fbd->aui, &fbd->fec); =20 phylink =3D phylink_create(&fbn->phylink_config, NULL, - fbnic_phylink_select_interface(fbn->aui), + fbnic_phylink_select_interface(fbd->aui), &fbnic_phylink_mac_ops); if (IS_ERR(phylink)) { err =3D PTR_ERR(phylink); --- base-commit: 8ebd24a7822cbae25beeafba49b2159d6a68a5f2 change-id: 20260513-fbnic-aui-change-42ac92da3d74 Best regards, --=20 Bobby Eshleman