Re: [PATCH net] pds_core: fix cmd_regs access racing BAR unmap on reset

[Paolo Abeni <pabeni@redhat.com>]

On 7/29/26 7:52 AM, Nikhil P. Rao wrote:
> pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
> clear/iounmap cmd_regs without devcmd_lock, and pdsc_firmware_update()'s
> download loop derefs cmd_regs after dropping and retaking the lock
> without re-checking. An FLR concurrent with a devlink flash can unmap
> cmd_regs under an in-flight devcmd, causing a NULL deref or a write to
> unmapped MMIO.
> 
> Take devcmd_lock across the BAR unmap/remap. Only the PF maps cmd_regs
> and runs devcmd, so guard the locking to the PF.
> 
> pdsc_unmap_bars() also clears info_regs, which has its own readers under
> config_lock (and a lockless debugfs reader); that teardown race is
> pre-existing and handled separately.
> 
> Fixes: e96094c1d11c ("pds_core: Clear BARs on reset")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260708212222.296202-1-nikhil.rao%40amd.com?part=3
> Assisted-by: Claude:claude-opus-4.8
> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
> ---
>  drivers/net/ethernet/amd/pds_core/fw.c   |  6 ++++++
>  drivers/net/ethernet/amd/pds_core/main.c | 10 +++++++++-
>  2 files changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amd/pds_core/fw.c b/drivers/net/ethernet/amd/pds_core/fw.c
> index fa626719e68d..cd7616ed9ef3 100644
> --- a/drivers/net/ethernet/amd/pds_core/fw.c
> +++ b/drivers/net/ethernet/amd/pds_core/fw.c
> @@ -134,6 +134,12 @@ int pdsc_firmware_update(struct pdsc *pdsc, const struct firmware *fw,
>  
>  		copy_sz = min_t(unsigned int, buf_sz, fw->size - offset);
>  		mutex_lock(&pdsc->devcmd_lock);
> +		if (!pdsc->cmd_regs) {

Sashiko notes this is still racy:

https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260729055258.1416225-1-nikhil.rao%40amd.com

The issue is marked as a pre-existing one, but IMHO is so strictly
related that deserve fixing in the same change.

/P