Re: [PATCH v2] fbnic: close fw_log race between users and teardown

[Chengfeng Ye]

On Thu, Feb 12, 2026 at 2:46 AM Jakub Kicinski <kuba@xxxxxxxxxx> wrote:
>
> On Wed, 11 Feb 2026 15:00:22 +0000 Chengfeng Ye wrote:
> > Fixes a theoretical race on fw_log between the teardown path and fw_log
> > write functions.
> >
> > fw_log is written inside fbnic_fw_log_write() and can be reached from
> > the mailbox handler fbnic_fw_msix_intr(), but fw_log is freed before
> > IRQ/MBX teardown during cleanup, resulting in a potential data race of
> > dereferencing a freed/null variable.
> >
> > Possible Interleaving scenario:
> >   CPU0: fbnic_fw_log_write()
> >           if (fbnic_fw_log_ready())   // true
> >           ... preempt ...
> >   CPU1: fbnic_fw_log_free()
> >           vfree(log->data_start);
> >           log->data_start = NULL;
> >   CPU0: continues, walks log->entries or writes to log->data_start
>
> Could you be more specific about the entry points for CPU0 and CPU1?
>
> > The initialization also has an incorrect order problem, as the fw_log
> > is currently allocated after MBX setup during initialization.
> > Fix the problems by adjusting the synchronization order to put
> > initialization in place before the mailbox is enabled, and not cleared
> > until after the mailbox has been disabled.
>
> Since this is a fix please add a Fixes tag pointing to where the buggy
> code was added.
> --
> pw-bot: cr

No problem, with issues resolved in the v3 patch just sent.

Thanks,
Chengfeng