From nobody Mon Jun 8 20:45:39 2026 Received: from mail-oa1-f47.google.com (mail-oa1-f47.google.com [209.85.160.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A4796406273 for ; Tue, 26 May 2026 17:21:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779816096; cv=none; b=Fj1Hv/Nc+PqhPYlqo4fJvXoCQyIu91fM6q8E0N92LQNQNbG7bDYqQ+gCojpjKerMmVoP0vqhKECgmb/ISz8N+tcfFXELsIbIG8aQ7Ndbp41wTRBjrnFmmkRSDA3pmiPUcBSCkTwb5EE0m2K12/0kcRrP7Oy+lqw80EuIbFq6u74= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779816096; c=relaxed/simple; bh=Gf5hju9X0zI7HaXMkAM9MGwv7IDWKHi3wvMpeMbYx1g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=Z+d3E8k7ZlERRJ96XSvBKqPmnBG1m5fb4jFc6eDSH+axkvKVXJ9AA9h1EZeR+p3cO7EiCZlREtljFqnWlkyZBiNiK3YYvzwlCFDhLcleKq7lO24swMbF3w8wD5RR0nlKCYOQOwsZ+g+Go1sG5y9Zk+V2hTrPG+OhISdTMBEqYJ4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Bp3aTO4w; arc=none smtp.client-ip=209.85.160.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Bp3aTO4w" Received: by mail-oa1-f47.google.com with SMTP id 586e51a60fabf-43ab7bfaa18so4224913fac.0 for ; Tue, 26 May 2026 10:21:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779816091; x=1780420891; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=VlryjWKduSUmbI5pIFwgJTa+Vts/T4ipj/ODH9sgEbU=; b=Bp3aTO4wUkaJpe9pFICVUiRgmU56jLVSRP//GEURNRwJBWa+tWt2icEQn5ALKB0B4Y f7EHZnrmMM4sRseAa6noIhuZKinHcJwF629t+KAr3gAX76PJFLmo7Rp/8hEuSwqYegFQ vaQrJLEMqJ7rnYTODXz6wEEL5d8VrMeMdrfxeN0jOgW2cHVnMlZUxmnRTfjTESGGIz6P 3tkR+O4U10g0wbFzC/3+TCfwNXWdeBIecxBahK8zg3LF2WVZedMhRAlKiD4EedGJSrNm RqlcOsRhHpq5cAPtTfKUkk0PJ/6JrfpaxS1Oo37uu8c/6ii9y0Z3sxxn7HOa34DyCuSY F/Nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779816091; x=1780420891; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=VlryjWKduSUmbI5pIFwgJTa+Vts/T4ipj/ODH9sgEbU=; b=UXyndEb1uEG7vclQ4r5H9JCUmNkC9BanznSzMon22cfOcUrLVkTdTUnaGrqp0dbCB9 sK3aHT/IpZyUSl5G3IQkxfhTi6FoggA1euLDzNJvK266MknsFQUj0SzJ9vVwrDTifK8a 40VeKtGcJoLqGyKaX5FM97PlVFw+aur4LZX+MdI9l0p/Kaged0Gwyhwd9mMVUBnrYW/U dEbZNZg3Grn+l1w4BWavcnAiNsgs1ZYETLHuMcfuSoNrpSXsPpNglPrzyBVBgChVTP+j rf6mQSfkfUKpKUFWZQOmtsqdXh0OzkQTt0re0X7C17dLgoxbpgkdm2avQL1wF3K36Qd0 2vuw== X-Forwarded-Encrypted: i=1; AFNElJ8CcgbKR4vuTNune9KGdCz5fcu/EBeIzOLcJNctNS+p/0kjpAAFy/bLok6tl6FAR/I9QJ7It5p+vqgFXc4=@vger.kernel.org X-Gm-Message-State: AOJu0YwFi9fExAKqforSPry+PNn/UBk1jnPtKtznluSsapWch/B5vVt5 tauwe6HtjH5MX/D1kpcG0rgM7tsg75OQrKkrzgdJHuKodGb57oK55LoN X-Gm-Gg: Acq92OFwYusxHkqPoIy/AKaMyXRE2OfJVTJtFhLQR0lQllgFWtBEsP/ZmdYye1uhEjc vXOvTlwgPkifBQGgeygywJZahcPxB74hbCD1o9OoxxbI9VRBgRyfMBeIVcwS2JPeoAgIq78eWXs fZUyQM9+HBKQ+xpFc5RPpMg4pf14fQZUz4q81LG3EnI+g4ouoEIy02fZ31rjy3FMFioViD8Zj64 rZI+FgjibP2eg/z/pLPXCjBRDVkqEsuuKQYlVosp30IuaVV6CMA6pXTcimQuuK60d0+isC13MlC /rVAIm5Ibs5wjL3S4gAkFat40xl9Wl3uzV65iuh1/b6uTvcF8mtnbfI6gkYlw1iRtR87T0X5eeb oQNj/z0RcJpE1tMXlIb226OQPrAz97Al8oIKyKO70zFduNUqDAsTsirknE+HlDMOchdqPqVQck5 LYI2iinYW16L3QaAts3Z8= X-Received: by 2002:a05:6820:f033:b0:69c:5d2b:407c with SMTP id 006d021491bc7-69d7ed3d5fcmr10217118eaf.58.1779816091590; Tue, 26 May 2026 10:21:31 -0700 (PDT) Received: from localhost ([2a03:2880:ff:71::]) by smtp.gmail.com with ESMTPSA id 006d021491bc7-69d8c3284c0sm6211061eaf.12.2026.05.26.10.21.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 10:21:31 -0700 (PDT) From: Bobby Eshleman Date: Tue, 26 May 2026 10:21:08 -0700 Subject: [PATCH net v2] eth: fbnic: move aui and fec from fbnic_net to fbnic_dev Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260526-fbnic-aui-change-v2-1-7c74cd48074f@meta.com> X-B4-Tracking: v=1; b=H4sIAIPWFWoC/2XNQQ6CMBBG4as0/5oaOiAiK+9hWNR2kFlQTItEQ 7i7SXXn+iXf25A4Cid0akPkVZLMAZ2iQsGNNtxZi0enQCU15dFUergFcdo+Rf96TdadydvKn2o UCo/Ig7wyeUXgBX2hMEpa5vjOm9Xk9BXJ/Iur0UYPrnR1wy03LV0mXuzBzRP6fd8/CK9hAbQAA AA= X-Change-ID: 20260513-fbnic-aui-change-42ac92da3d74 To: Alexander Duyck , Jakub Kicinski , kernel-team@meta.com, Andrew Lunn , "David S. Miller" , Eric Dumazet , Paolo Abeni , Russell King Cc: Mohsin Bashir , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Bobby Eshleman X-Mailer: b4 0.14.3 From: Bobby Eshleman fbnic_mdio_read_pmd() reaches through fbd->netdev to netdev_priv() in order to read fbn->aui: if (fbd->netdev) { fbn =3D netdev_priv(fbd->netdev); if (fbn->aui < FBNIC_AUI_UNKNOWN) aui =3D fbn->aui; } This can lead to a TOCTOU bug where fbd->netdev is checked after being freed but before being cleared. Both aui and fec describe the link configuration of the NIC, so move them to fbnic_dev together. The MDIO layer (and other fbd-level code) can read them directly without bouncing through fbd->netdev. The hazardous accesses through fbd->netdev are dropped. Fixes: d0ce9fd7eae0 ("fbnic: Add SW shim for MDIO interface to PMD and PCS") Suggested-by: Jakub Kicinski Reviewed-by: Alexander Duyck Signed-off-by: Bobby Eshleman --- Changes in v2: - rebase over net/main - Link to v1: https://lore.kernel.org/r/20260521-fbnic-aui-change-v1-1-fc0c= 46e8e682@meta.com --- drivers/net/ethernet/meta/fbnic/fbnic.h | 3 +++ drivers/net/ethernet/meta/fbnic/fbnic_irq.c | 2 +- drivers/net/ethernet/meta/fbnic/fbnic_mac.c | 3 +-- drivers/net/ethernet/meta/fbnic/fbnic_mdio.c | 9 ++------- drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 3 --- drivers/net/ethernet/meta/fbnic/fbnic_phylink.c | 18 ++++++++++-------- 6 files changed, 17 insertions(+), 21 deletions(-) diff --git a/drivers/net/ethernet/meta/fbnic/fbnic.h b/drivers/net/ethernet= /meta/fbnic/fbnic.h index d0715695c43e..76cfaf77b5ef 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic.h +++ b/drivers/net/ethernet/meta/fbnic/fbnic.h @@ -88,6 +88,9 @@ struct fbnic_dev { unsigned long end_of_pmd_training; u8 pmd_state; =20 + u8 aui; + u8 fec; + /* Local copy of hardware statistics */ struct fbnic_hw_stats hw_stats; =20 diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_irq.c b/drivers/net/ethe= rnet/meta/fbnic/fbnic_irq.c index 5e383d40abc7..03dbb53b33d9 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_irq.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_irq.c @@ -132,7 +132,7 @@ static irqreturn_t fbnic_mac_msix_intr(int __always_unu= sed irq, void *data) fbn =3D netdev_priv(fbd->netdev); =20 /* Record link down events */ - if (!fbd->mac->get_link(fbd, fbn->aui, fbn->fec)) + if (!fbd->mac->get_link(fbd, fbd->aui, fbd->fec)) phylink_pcs_change(fbn->pcs, false); =20 return IRQ_HANDLED; diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_mac.c b/drivers/net/ethe= rnet/meta/fbnic/fbnic_mac.c index 53b7a938b4c2..e911dbf41b46 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_mac.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_mac.c @@ -515,7 +515,6 @@ static u32 __fbnic_mac_cmd_config_asic(struct fbnic_dev= *fbd, /* Enable MAC Promiscuous mode and Tx padding */ u32 command_config =3D FBNIC_MAC_COMMAND_CONFIG_TX_PAD_EN | FBNIC_MAC_COMMAND_CONFIG_PROMISC_EN; - struct fbnic_net *fbn =3D netdev_priv(fbd->netdev); =20 /* Disable pause frames if not enabled */ if (!tx_pause) @@ -524,7 +523,7 @@ static u32 __fbnic_mac_cmd_config_asic(struct fbnic_dev= *fbd, command_config |=3D FBNIC_MAC_COMMAND_CONFIG_RX_PAUSE_DIS; =20 /* Disable fault handling if no FEC is requested */ - if (fbn->fec =3D=3D FBNIC_FEC_OFF) + if (fbd->fec =3D=3D FBNIC_FEC_OFF) command_config |=3D FBNIC_MAC_COMMAND_CONFIG_FLT_HDL_DIS; =20 return command_config; diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c b/drivers/net/eth= ernet/meta/fbnic/fbnic_mdio.c index 709041f7fc43..49895430c97d 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_mdio.c @@ -5,7 +5,6 @@ #include =20 #include "fbnic.h" -#include "fbnic_netdev.h" =20 #define DW_VENDOR BIT(15) #define FBNIC_PCS_VENDOR BIT(9) @@ -15,18 +14,14 @@ static int fbnic_mdio_read_pmd(struct fbnic_dev *fbd, int addr, int regnum) { u8 aui =3D FBNIC_AUI_UNKNOWN; - struct fbnic_net *fbn; int ret =3D 0; =20 /* We don't need a second PMD, just one can handle both lanes */ if (addr) return 0; =20 - if (fbd->netdev) { - fbn =3D netdev_priv(fbd->netdev); - if (fbn->aui < FBNIC_AUI_UNKNOWN) - aui =3D fbn->aui; - } + if (fbd->aui < FBNIC_AUI_UNKNOWN) + aui =3D fbd->aui; =20 switch (regnum) { case MDIO_DEVID1: diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h b/drivers/net/e= thernet/meta/fbnic/fbnic_netdev.h index eded20b0e9e4..213253a818bb 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h +++ b/drivers/net/ethernet/meta/fbnic/fbnic_netdev.h @@ -46,9 +46,6 @@ struct fbnic_net { struct phylink_config phylink_config; struct phylink_pcs *pcs; =20 - u8 aui; - u8 fec; - /* Cached top bits of the HW time counter for 40b -> 64b conversion */ u32 time_high; /* Protect readers of @time_offset, writers take @time_lock. */ diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c b/drivers/net/= ethernet/meta/fbnic/fbnic_phylink.c index 09c5225111be..61463bcb6431 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_phylink.c @@ -65,6 +65,7 @@ int fbnic_phylink_ethtool_ksettings_get(struct net_device= *netdev, struct ethtool_link_ksettings *cmd) { struct fbnic_net *fbn =3D netdev_priv(netdev); + struct fbnic_dev *fbd =3D fbn->fbd; int err; =20 err =3D phylink_ethtool_ksettings_get(fbn->phylink, cmd); @@ -72,7 +73,7 @@ int fbnic_phylink_ethtool_ksettings_get(struct net_device= *netdev, unsigned long *supp =3D cmd->link_modes.supported; =20 cmd->base.port =3D PORT_DA; - cmd->lanes =3D (fbn->aui & FBNIC_AUI_MODE_R2) ? 2 : 1; + cmd->lanes =3D (fbd->aui & FBNIC_AUI_MODE_R2) ? 2 : 1; =20 fbnic_phylink_get_supported_fec_modes(supp); } @@ -84,11 +85,12 @@ int fbnic_phylink_get_fecparam(struct net_device *netde= v, struct ethtool_fecparam *fecparam) { struct fbnic_net *fbn =3D netdev_priv(netdev); + struct fbnic_dev *fbd =3D fbn->fbd; =20 - if (fbn->fec & FBNIC_FEC_RS) { + if (fbd->fec & FBNIC_FEC_RS) { fecparam->active_fec =3D ETHTOOL_FEC_RS; fecparam->fec =3D ETHTOOL_FEC_RS; - } else if (fbn->fec & FBNIC_FEC_BASER) { + } else if (fbd->fec & FBNIC_FEC_BASER) { fecparam->active_fec =3D ETHTOOL_FEC_BASER; fecparam->fec =3D ETHTOOL_FEC_BASER; } else { @@ -96,7 +98,7 @@ int fbnic_phylink_get_fecparam(struct net_device *netdev, fecparam->fec =3D ETHTOOL_FEC_OFF; } =20 - if (fbn->aui & FBNIC_AUI_MODE_PAM4) + if (fbd->aui & FBNIC_AUI_MODE_PAM4) fecparam->fec |=3D ETHTOOL_FEC_AUTO; =20 return 0; @@ -120,7 +122,7 @@ fbnic_phylink_mac_prepare(struct phylink_config *config= , unsigned int mode, struct fbnic_net *fbn =3D netdev_priv(netdev); struct fbnic_dev *fbd =3D fbn->fbd; =20 - fbd->mac->prepare(fbd, fbn->aui, fbn->fec); + fbd->mac->prepare(fbd, fbd->aui, fbd->fec); =20 return 0; } @@ -140,7 +142,7 @@ fbnic_phylink_mac_finish(struct phylink_config *config,= unsigned int mode, struct fbnic_dev *fbd =3D fbn->fbd; =20 /* Retest the link state and restart interrupts */ - fbd->mac->get_link(fbd, fbn->aui, fbn->fec); + fbd->mac->get_link(fbd, fbd->aui, fbd->fec); =20 return 0; } @@ -227,10 +229,10 @@ int fbnic_phylink_create(struct net_device *netdev) __set_bit(PHY_INTERFACE_MODE_25GBASER, fbn->phylink_config.supported_interfaces); =20 - fbnic_mac_get_fw_settings(fbd, &fbn->aui, &fbn->fec); + fbnic_mac_get_fw_settings(fbd, &fbd->aui, &fbd->fec); =20 phylink =3D phylink_create(&fbn->phylink_config, NULL, - fbnic_phylink_select_interface(fbn->aui), + fbnic_phylink_select_interface(fbd->aui), &fbnic_phylink_mac_ops); if (IS_ERR(phylink)) { err =3D PTR_ERR(phylink); --- base-commit: c66d7c3c1f173cf73a2a2f8302666d86beafff22 change-id: 20260513-fbnic-aui-change-42ac92da3d74 Best regards, --=20 Bobby Eshleman