[PATCH net v2 0/2] ionic: fix port_info lifetime bugs

[Eric Joyner <eric.joyner@amd.com>]

Two fixes for the lifetime of the ionic port_info DMA buffer.

Patch 1 fixes a use-after-free. ionic_port_init() allocates port_info
only when the pointer is NULL, but its error path frees the buffer
unconditionally. On the firmware recovery paths,
ionic_lif_handle_fw_up() and ionic_reset_done(), the buffer belongs to
an earlier successful init, so a failed PORT_INIT frees it under any
ethtool op that is already reading it. The error path now frees only
what the same call allocated.

Patch 2 (v1 patch 3) fixes a leak of the same buffer when probe fails
after the port has been set up.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
---
Changes in v2:
- Nikhil's work replaces v1 patches 1 and 2 with a fix for the root
  cause. With the ionic_port_init() error path no longer freeing a
  buffer it did not allocate, port_info is never freed or set to NULL
  while the netdev is registered, which also covers
  ionic_sw_stats_get_values() and ionic_reset_link_down_count(). As the
  Sashiko review pointed out, the v1 NULL checks could not stop a reader
  that had already loaded the pointer, and ionic_reset_prepare() already
  detaches the netdev via ionic_stop_queues_reconfig() before any
  port_info or BAR teardown, so the extra detach did not close the window.
- If PORT_INIT fails during recovery, the old buffer is now kept. The
  netdev stays detached with IONIC_LIF_F_FW_RESET set until a later
  PORT_INIT succeeds, so its stale contents are not reported.
- On freeing without PORT_RESET after a timed-out PORT_INIT: that free
  now runs only when the same call allocated the buffer, i.e. at
  probe. LIF_INIT is never sent after a failed PORT_INIT on any path,
  and Nikhil checked that the firmware only writes port_info once the
  LIF is initialized.
- Patch 2: correct the Fixes tag to 0de38d9f1dba, which removed the
  ionic_port_reset() call from the probe unwind, and reword the
  changelog to match. No code change.
- Not addressed here: an ethtool op can still run while the PCI reset
  path unmaps the BARs in ionic_clear_pci() and tears down device state
  in ionic_dev_teardown(). The ignored PORT_STATE result in
  ionic_port_init() is also unchanged.
- Rebase onto current net.
- Link to v1: https://lore.kernel.org/r/20260814-ionic-port-info-lifetime-v1-0-f73b1a06c5f6@amd.com

---
Eric Joyner (1):
      ionic: free port_info when probe fails after the port is set up

Nikhil P. Rao (1):
      ionic: fix port_info use-after-free on firmware recovery

 drivers/net/ethernet/pensando/ionic/ionic_bus_pci.c |  1 +
 drivers/net/ethernet/pensando/ionic/ionic_main.c    | 13 +++++++++----
 2 files changed, 10 insertions(+), 4 deletions(-)
---
base-commit: 045958acaa75205b31578cb22c4345e28dd2e4bf
change-id: 20260814-ionic-port-info-lifetime-3163779cb298

Best regards,
-- 
Eric Joyner <eric.joyner@amd.com>