From: Anthony Pighin <anthony.pighin@nokia.com>
To: Jaidev Shastri <jaidevshastri@vt.edu>
Cc: Ioana Ciornei <ioana.ciornei@nxp.com>,
"Christophe Leroy (CS GROUP)" <chleroy@kernel.org>,
linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH] soc: fsl: dpio: publish the dpaa2_io object only after it is initialised
Date: Wed, 30 Sep 2026 20:08:45 -0400 [thread overview]
Message-ID: <20261001000845.3627423-1-anthony.pighin@nokia.com> (raw)
In-Reply-To: <20260921-mb-dpio-v1-1-9e24539059c1@vt.edu>
On Mon, Sep 22, 2026, Jaidev Shastri wrote:
> obj->dev is assigned after the lock is dropped, so a reader can pick the
> object up and pass a NULL supplier to device_link_add(), which fails
> with -EINVAL and fails the consumer's probe.
The object comes from kmalloc(), so obj->dev is not NULL but whatever
was left in that memory. We hit this on LX2160A boards as an
intermittent boot panic, with the deferred dpaa2-eth probe racing the
DPIO probes.
Unable to handle kernel paging request at virtual address deadbeefdeadbfd7
pc : device_link_add+0x80/0x700
x20: deadbeefdeadbeef
Call trace:
device_link_add+0x80/0x700
dpaa2_io_service_register+0x40/0x120 [fsl_mc_dpio]
dpaa2_eth_setup_dpio+0x128/0x468 [fsl_dpaa2_eth]
dpaa2_eth_probe+0x1dc/0x908 [fsl_dpaa2_eth]
Widening the window with an msleep(50) after the spin_unlock() makes it
panic on every boot. With this patch applied to 6.12 and the same
msleep(50) kept after the spin_unlock(), five boots in a row were clean.
Since this crashes real systems, could v2 say so in the commit message
and carry these tags so it reaches the stable kernels?
Fixes: cf9ff75d15a9 ("soc: fsl: dpio: store a backpointer to the device backing the dpaa2_io")
Fixes: 69651bd8d303 ("soc: fsl: dpio: add Net DIM integration")
Cc: stable@vger.kernel.org
Tested-by: Anthony Pighin <anthony.pighin@nokia.com>
next prev parent reply other threads:[~2026-10-01 0:10 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-22 0:50 [PATCH] soc: fsl: dpio: publish the dpaa2_io object only after it is initialised Jaidev Shastri via B4 Relay
2026-10-01 0:08 ` Anthony Pighin [this message]
2026-10-02 9:50 ` Ioana Ciornei
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261001000845.3627423-1-anthony.pighin@nokia.com \
--to=anthony.pighin@nokia.com \
--cc=chleroy@kernel.org \
--cc=ioana.ciornei@nxp.com \
--cc=jaidevshastri@vt.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox