[PATCH net v2 0/2] ionic: fix port_info lifetime bugs

[PATCH net v2 0/2] ionic: fix port_info lifetime bugs

[Eric Joyner]

Two fixes for the lifetime of the ionic port_info DMA buffer.

Patch 1 fixes a use-after-free. ionic_port_init() allocates port_info
only when the pointer is NULL, but its error path frees the buffer
unconditionally. On the firmware recovery paths,
ionic_lif_handle_fw_up() and ionic_reset_done(), the buffer belongs to
an earlier successful init, so a failed PORT_INIT frees it under any
ethtool op that is already reading it. The error path now frees only
what the same call allocated.

Patch 2 (v1 patch 3) fixes a leak of the same buffer when probe fails
after the port has been set up.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
---
Changes in v2:
- Nikhil's work replaces v1 patches 1 and 2 with a fix for the root
  cause. With the ionic_port_init() error path no longer freeing a
  buffer it did not allocate, port_info is never freed or set to NULL
  while the netdev is registered, which also covers
  ionic_sw_stats_get_values() and ionic_reset_link_down_count(). As the
  Sashiko review pointed out, the v1 NULL checks could not stop a reader
  that had already loaded the pointer, and ionic_reset_prepare() already
  detaches the netdev via ionic_stop_queues_reconfig() before any
  port_info or BAR teardown, so the extra detach did not close the window.
- If PORT_INIT fails during recovery, the old buffer is now kept. The
  netdev stays detached with IONIC_LIF_F_FW_RESET set until a later
  PORT_INIT succeeds, so its stale contents are not reported.
- On freeing without PORT_RESET after a timed-out PORT_INIT: that free
  now runs only when the same call allocated the buffer, i.e. at
  probe. LIF_INIT is never sent after a failed PORT_INIT on any path,
  and Nikhil checked that the firmware only writes port_info once the
  LIF is initialized.
- Patch 2: correct the Fixes tag to 0de38d9f1dba, which removed the
  ionic_port_reset() call from the probe unwind, and reword the
  changelog to match. No code change.
- Not addressed here: an ethtool op can still run while the PCI reset
  path unmaps the BARs in ionic_clear_pci() and tears down device state
  in ionic_dev_teardown(). The ignored PORT_STATE result in
  ionic_port_init() is also unchanged.
- Rebase onto current net.
- Link to v1: https://lore.kernel.org/r/20260814-ionic-port-info-lifetime-v1-0-f73b1a06c5f6@amd.com

---
Eric Joyner (1):
      ionic: free port_info when probe fails after the port is set up

Nikhil P. Rao (1):
      ionic: fix port_info use-after-free on firmware recovery

 drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c |  1 +
 drivers/net/ethernet/pensando/ionic/ionic_main.c    | 13 +++++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)
---
base-commit: 045958acaa75205b31578cb22c4345e28dd2e4bf
change-id: 20260814-ionic-port-info-lifetime-3163779cb298

Best regards,
-- 
Eric Joyner <eric.joyner@amd.com>

[PATCH net v2 1/2] ionic: fix port_info use-after-free on firmware recovery

[Eric Joyner]

From: "Nikhil P. Rao" <nikhil.rao@amd.com>

ionic_port_init() allocates port_info when the pointer is NULL, but its
error path frees it without checking whether this call allocated it.
Before commit ddc5911b9bd2 ("ionic: call ionic_port_init after
fw-upgrade") the function returned early when the buffer already
existed, so the two were symmetric.

Since then a failed PORT_INIT on either recovery path - fw_up or
reset_done - frees a buffer an earlier init owns, while the netdev is
registered and the ethtool ops are reading it.

Free only what this call allocated.

Fixes: ddc5911b9bd2 ("ionic: call ionic_port_init after fw-upgrade")
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
---
 drivers/net/ethernet/pensando/ionic/ionic_main.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
index 10501be9ef95..38b47b959a11 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
@@ -722,6 +722,7 @@ int ionic_port_init(struct ionic *ionic)
 {
 	struct ionic_identity *ident = &ionic->ident;
 	struct ionic_dev *idev = &ionic->idev;
+	bool allocated = false;
 	size_t sz;
 	int err;
 
@@ -733,6 +734,8 @@ int ionic_port_init(struct ionic *ionic)
 						     GFP_KERNEL);
 		if (!idev->port_info)
 			return -ENOMEM;
+
+		allocated = true;
 	}
 
 	/* If the driver knows about more "extra stats" than the firmware,
@@ -757,10 +760,12 @@ int ionic_port_init(struct ionic *ionic)
 	mutex_unlock(&ionic->dev_cmd_lock);
 	if (err) {
 		dev_err(ionic->dev, "Failed to init port\n");
-		dma_free_coherent(ionic->dev, idev->port_info_sz,
-				  idev->port_info, idev->port_info_pa);
-		idev->port_info = NULL;
-		idev->port_info_pa = 0;
+		if (allocated) {
+			dma_free_coherent(ionic->dev, idev->port_info_sz,
+					  idev->port_info, idev->port_info_pa);
+			idev->port_info = NULL;
+			idev->port_info_pa = 0;
+		}
 	}
 
 	return err;

-- 
2.53.0

Re: [PATCH net v2 1/2] ionic: fix port_info use-after-free on firmware recovery

[Vadim Fedorenko]

On 16/10/2026 00:03, Eric Joyner wrote:
> From: "Nikhil P. Rao" <nikhil.rao@amd.com>
> 
> ionic_port_init() allocates port_info when the pointer is NULL, but its
> error path frees it without checking whether this call allocated it.
> Before commit ddc5911b9bd2 ("ionic: call ionic_port_init after
> fw-upgrade") the function returned early when the buffer already
> existed, so the two were symmetric.
> 
> Since then a failed PORT_INIT on either recovery path - fw_up or
> reset_done - frees a buffer an earlier init owns, while the netdev is
> registered and the ethtool ops are reading it.
> 
> Free only what this call allocated.
> 
> Fixes: ddc5911b9bd2 ("ionic: call ionic_port_init after fw-upgrade")
> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
> Signed-off-by: Eric Joyner <eric.joyner@amd.com>
> ---
>   drivers/net/ethernet/pensando/ionic/ionic_main.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
> index 10501be9ef95..38b47b959a11 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
> @@ -722,6 +722,7 @@ int ionic_port_init(struct ionic *ionic)
>   {
>   	struct ionic_identity *ident = &ionic->ident;
>   	struct ionic_dev *idev = &ionic->idev;
> +	bool allocated = false;
>   	size_t sz;
>   	int err;
>   
> @@ -733,6 +734,8 @@ int ionic_port_init(struct ionic *ionic)
>   						     GFP_KERNEL);
>   		if (!idev->port_info)
>   			return -ENOMEM;
> +
> +		allocated = true;
>   	}
>   
>   	/* If the driver knows about more "extra stats" than the firmware,
> @@ -757,10 +760,12 @@ int ionic_port_init(struct ionic *ionic)
>   	mutex_unlock(&ionic->dev_cmd_lock);
>   	if (err) {
>   		dev_err(ionic->dev, "Failed to init port\n");
> -		dma_free_coherent(ionic->dev, idev->port_info_sz,
> -				  idev->port_info, idev->port_info_pa);
> -		idev->port_info = NULL;
> -		idev->port_info_pa = 0;
> +		if (allocated) {
> +			dma_free_coherent(ionic->dev, idev->port_info_sz,
> +					  idev->port_info, idev->port_info_pa);
> +			idev->port_info = NULL;
> +			idev->port_info_pa = 0;
> +		}
>   	}
>   
>   	return err;
> 
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

[PATCH net v2 2/2] ionic: free port_info when probe fails after the port is set up

[Eric Joyner]

ionic_probe() allocates the port_info DMA buffer via ionic_setup_one()
-> ionic_port_init(). If probe then fails anywhere after that, it
unwinds through err_out_pci, which never calls ionic_port_reset();
ionic_dev_teardown() and ionic_clear_pci() do not touch port_info, and
so the buffer is leaked. The call was lost when the setup code was
moved into ionic_setup_one().

Since ionic_remove() already frees the port_info DMA buffer with
ionic_port_reset(), call that on the probe error path too. Every path
to err_out_pci runs after ionic_setup_one() succeeded, so the BARs are
still mapped and the firmware gets a PORT_RESET before the buffer is
freed, the same order as in ionic_remove().

Fixes: 0de38d9f1dba ("ionic: extract common bits from ionic_probe")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
---
 drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
index 05f19489ec5c..68b3bceedd99 100644
--- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
+++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
@@ -397,6 +397,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 err_out_free_irqs:
 	ionic_bus_free_irq_vectors(ionic);
 err_out_pci:
+	ionic_port_reset(ionic);
 	ionic_dev_teardown(ionic);
 	ionic_clear_pci(ionic);
 	ionic_debugfs_del_dev(ionic);

-- 
2.53.0

Re: [PATCH net v2 2/2] ionic: free port_info when probe fails after the port is set up

[Vadim Fedorenko]

On 16/10/2026 00:03, Eric Joyner wrote:
> ionic_probe() allocates the port_info DMA buffer via ionic_setup_one()
> -> ionic_port_init(). If probe then fails anywhere after that, it
> unwinds through err_out_pci, which never calls ionic_port_reset();
> ionic_dev_teardown() and ionic_clear_pci() do not touch port_info, and
> so the buffer is leaked. The call was lost when the setup code was
> moved into ionic_setup_one().
> 
> Since ionic_remove() already frees the port_info DMA buffer with
> ionic_port_reset(), call that on the probe error path too. Every path
> to err_out_pci runs after ionic_setup_one() succeeded, so the BARs are
> still mapped and the firmware gets a PORT_RESET before the buffer is
> freed, the same order as in ionic_remove().
> 
> Fixes: 0de38d9f1dba ("ionic: extract common bits from ionic_probe")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: Eric Joyner <eric.joyner@amd.com>
> ---
>   drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
> index 05f19489ec5c..68b3bceedd99 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c
> @@ -397,6 +397,7 @@ static int ionic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
>   err_out_free_irqs:
>   	ionic_bus_free_irq_vectors(ionic);
>   err_out_pci:
> +	ionic_port_reset(ionic);
>   	ionic_dev_teardown(ionic);
>   	ionic_clear_pci(ionic);
>   	ionic_debugfs_del_dev(ionic);
> 
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

Re: [PATCH net v2 0/2] ionic: fix port_info lifetime bugs

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net v2 0/2] ionic: fix port_info lifetime bugs

[Eric Joyner]

On 10/15/2026 4:08 PM, netdev-bot+sinfo@kernel.org wrote:
> Caution: This message originated from an External Source. Use proper caution when opening attachments, clicking links, or responding.
> 
> 
> Hi!
> 
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
> 
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
> 
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
> 
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
> 
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
> 
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.

Ok:

- This was discovered by a Sashiko review for v1 of a different patchset;
we evaluated the discovery internally and it looked like something that
should be fixed.

- It's theoretical by finding, but...

- I tested it on an actual DSC3 "Pollara" with a hacked driver and test kernel
to cause both issues:
  - Had PORT_INIT fail during PCI reset recovery and saw that the port_info
buffer was freed while the netdev was still registered, meaning that the netdev
ethtool ops could get a NULL pointer for port_info
  - Made probe fail on purpose at ionic_setup_one() to verify that port_info
memory and DMA allocation was being leaked

  and then checked that the patched one did not have these issues.

- Eric