Netdev List
 help / color / mirror / Atom feed
From: Jakub Kicinski <kuba@kernel.org>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org, edumazet@google.com, pabeni@redhat.com,
	andrew+netdev@lunn.ch, horms@kernel.org,
	maxime.chevallier@bootlin.com, danieller@nvidia.com,
	petrm@nvidia.com, o.rempel@pengutronix.de, idosch@nvidia.com,
	Jakub Kicinski <kuba@kernel.org>,
	andrew@lunn.ch
Subject: [PATCH net 3/9] ethtool: module: avoid racy updates to dev->ethtool bitfield
Date: Fri, 22 May 2026 16:13:06 -0700	[thread overview]
Message-ID: <20260522231312.1710836-4-kuba@kernel.org> (raw)
In-Reply-To: <20260522231312.1710836-1-kuba@kernel.org>

When reviewing other changes Gemini points out that we currently
update module_fw_flash_in_progress without holding any locks.
Since module_fw_flash_in_progress is part of a bitfield this
is not great, updates to other fields may be lost.

We could use a bool and sprinkle some READ_ONCE/WRITE_ONCE here
but seems like the issue is rather than the work is an unusual
writer. The other writers already hold the right locks. So just
very briefly take these locks when the work completes.

Note that nothing ever cancels the FW update work, so there's
no concern with deadlocks vs cancel.

Fixes: 32b4c8b53ee7 ("ethtool: Add ability to flash transceiver modules' firmware")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: andrew@lunn.ch
CC: petrm@nvidia.com
CC: danieller@nvidia.com
---
 net/ethtool/module.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ethtool/module.c b/net/ethtool/module.c
index 392c03935e5e..cdb85e19a23b 100644
--- a/net/ethtool/module.c
+++ b/net/ethtool/module.c
@@ -221,14 +221,22 @@ static void module_flash_fw_work_list_del(struct list_head *list)
 static void module_flash_fw_work(struct work_struct *work)
 {
 	struct ethtool_module_fw_flash *module_fw;
+	struct net_device *dev;
 
 	module_fw = container_of(work, struct ethtool_module_fw_flash, work);
+	dev = module_fw->fw_update.dev;
 
 	ethtool_cmis_fw_update(&module_fw->fw_update);
 
 	module_flash_fw_work_list_del(&module_fw->list);
-	module_fw->fw_update.dev->ethtool->module_fw_flash_in_progress = false;
-	netdev_put(module_fw->fw_update.dev, &module_fw->dev_tracker);
+
+	rtnl_lock();
+	netdev_lock_ops(dev);
+	dev->ethtool->module_fw_flash_in_progress = false;
+	netdev_unlock_ops(dev);
+	rtnl_unlock();
+
+	netdev_put(dev, &module_fw->dev_tracker);
 	release_firmware(module_fw->fw_update.fw);
 	kfree(module_fw);
 }
-- 
2.54.0


  parent reply	other threads:[~2026-05-22 23:13 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-05-22 23:13 [PATCH net 0/9] ethtool: module: fix a handful of small bugs Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 1/9] ethtool: module: call ethnl_ops_complete() on module flash errors Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 2/9] ethtool: module: avoid leaking a netdev ref " Jakub Kicinski
2026-05-22 23:13 ` Jakub Kicinski [this message]
2026-05-22 23:13 ` [PATCH net 4/9] ethtool: module: check fw_flash_in_progress under rtnl_lock Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 5/9] ethtool: module: fix cleanup if socket used for flashing multiple devices Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 6/9] ethtool: cmis: require exact CDB reply length Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 7/9] ethtool: cmis: fix u16-to-u8 truncation of msleep_pre_rpl Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 8/9] ethtool: cmis: validate start_cmd_payload_size from module Jakub Kicinski
2026-05-22 23:13 ` [PATCH net 9/9] ethtool: cmis: validate fw->size against start_cmd_payload_size Jakub Kicinski

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260522231312.1710836-4-kuba@kernel.org \
    --to=kuba@kernel.org \
    --cc=andrew+netdev@lunn.ch \
    --cc=andrew@lunn.ch \
    --cc=danieller@nvidia.com \
    --cc=davem@davemloft.net \
    --cc=edumazet@google.com \
    --cc=horms@kernel.org \
    --cc=idosch@nvidia.com \
    --cc=maxime.chevallier@bootlin.com \
    --cc=netdev@vger.kernel.org \
    --cc=o.rempel@pengutronix.de \
    --cc=pabeni@redhat.com \
    --cc=petrm@nvidia.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox