Re: [PATCH net v2] eth: fbnic: fix double-free of PCS on phylink creation failure

[Bobby Eshleman <bobbyeshleman@gmail.com>]

On Thu, May 07, 2026 at 09:01:27AM -0700, Jakub Kicinski wrote:
> On Thu, 7 May 2026 08:35:21 -0700 Bobby Eshleman wrote:
> > > > fbd is a devlink priv, not netdev priv, touching it after free_netdev()
> > > > is perfectly fine. I wish Gemini tried a *little* harder instead of
> > > > guessing :| Sorry for not commenting earlier.  
> > > 
> > > Ugh, not enough coffee. It's complaining about MDIO reads, I think
> > > that's valid.  
> > 
> > It is, but I think the race pre-exists.
> > 
> > static int
> > fbnic_mdio_read_pmd(struct fbnic_dev *fbd, int addr, int regnum)
> > [...]
> > 	if (fbd->netdev) {
> > 		fbn = netdev_priv(fbd->netdev);
> > 		if (fbn->aui < FBNIC_AUI_UNKNOWN)
> > 			aui = fbn->aui;
> > 	}
> > 
> > 
> > Definitely possible that ->netdev gets freed concurrently with
> > fbd->netdev evaluating to true... but fbnic_netdev_free() faces the same
> > race.
> > 
> > I'm open to fixing this all at once, if preferred. Probably need to look
> > at some of the other fbnic_net ptr guards too.
> 
> I agree with Paolo, seems separate.
> 
> FWIW I think the fix may be to move the single aui field that mdio
> cares about to fbd instead of fbn ? Feels like the problem is due
> to a layering violation, mdio should not be touching fbn fields.

SGTM. And I'll take a look at moving aui.

Thanks,
Bobby