Re: [PATCH net v3] net: ethernet: mtk_eth_soc: allocate dummy netdev

[Simon Horman <horms@kernel.org>]

On Thu, Sep 24, 2026 at 11:51:37PM +0300, Sandeep Haemoon wrote:
> The RX rings and the shared NAPI are carried by an internal "dummy" netdev
> (eth->dummy_dev). mtk_probe() creates that dummy device, and adds the
> shared tx/rx NAPI to it, only after the MAC netdevs have been registered.
> That order has been there since the MT7623 support was added and leaves a
> window in which the netdevs are visible to the network core before the
> shared NAPI and the dummy device exist.
> 
> If anything brings the first netdev up during that window (e.g. netifd
> opening the WAN link the instant the interface is registered), the
> first-open path runs without them. On NETSYS v2 and later SoCs
> mtk_rx_alloc() -> __xdp_rxq_info_reg() then dereferences eth->dummy_dev ==
> NULL:
> 
>   WARNING: CPU: ... Missing net_device from driver
> 
> in net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs
> (MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open
> instead calls napi_enable() on a napi_struct that netif_napi_add() has not
> initialised yet and dereferences a NULL napi->dev.
> 
> Allocate the dummy netdev and add the shared tx/rx NAPI to it before the
> register_netdev() loop. Both the dummy-allocation failure and a
> register_netdev() failure now unwind through mtk_unreg_dev(), which
> unregisters the net_device notifiers and the netdevs registered so far,
> stopping a concurrently-opened netdev (ndo_stop) and its NAPI before the
> dummy carrier is freed.
> 
> A netdev that opened during the window can also have queued the
> frame-engine reset worker (via the tx watchdog or phylink), so the probe
> error path now cancels eth->pending_work before freeing the shared state,
> as mtk_cleanup() already does on remove.
> 
> Fixes: 656e705243fd ("net-next: mediatek: add support for MT7623 ethernet")
> Signed-off-by: Sandeep Haemoon <sandeeph@loljews.com>
> ---
> 
> Changes in v3:
>   - Changelog now also covers the NETSYS v1 SoCs (MT7621/MT7622/MT7623/
>     MT7629): there is no page pool, so the same early ndo_open reaches
>     napi_enable() on a NAPI that netif_napi_add() has not initialised yet
>     and dereferences a NULL napi->dev, not the __xdp_rxq_info_reg() WARN.
>   - Fixes: now points at 656e705243fd ("net-next: mediatek: add support for
>     MT7623 ethernet"), which introduced the register_netdev()-before-
>     init_dummy_netdev() ordering, rather than b209bd6d0bff, which only turned
>     the embedded dummy_dev into a late-allocated pointer.
>   - The probe error path now cancels eth->pending_work before freeing the
>     dummy carrier and the rest of the shared state: a netdev opened during the
>     window can have queued the frame-engine reset worker (tx watchdog or
>     phylink), which takes rtnl and drives the hardware.
>   - Rebased on current net (includes Lorenzo's unregister-net-devices fix).
> 
> The notifier-unregister gap on the pre-register error paths (devm_request_irq()/
> mtk_mdio_init()/mtk_ppe_init() failures) flagged in the same review is
> pre-existing and intentionally left for a separate change.

Reviewed-by: Simon Horman <horms@kernel.org>