Re: [PATCH net v2] eth: fbnic: fix double-free of PCS on phylink creation failure

[Jakub Kicinski]

On Thu, 7 May 2026 08:35:21 -0700 Bobby Eshleman wrote:
> > > fbd is a devlink priv, not netdev priv, touching it after free_netdev()
> > > is perfectly fine. I wish Gemini tried a *little* harder instead of
> > > guessing :| Sorry for not commenting earlier.  
> > 
> > Ugh, not enough coffee. It's complaining about MDIO reads, I think
> > that's valid.  
> 
> It is, but I think the race pre-exists.
> 
> static int
> fbnic_mdio_read_pmd(struct fbnic_dev *fbd, int addr, int regnum)
> [...]
> 	if (fbd->netdev) {
> 		fbn = netdev_priv(fbd->netdev);
> 		if (fbn->aui < FBNIC_AUI_UNKNOWN)
> 			aui = fbn->aui;
> 	}
> 
> 
> Definitely possible that ->netdev gets freed concurrently with
> fbd->netdev evaluating to true... but fbnic_netdev_free() faces the same
> race.
> 
> I'm open to fixing this all at once, if preferred. Probably need to look
> at some of the other fbnic_net ptr guards too.

I agree with Paolo, seems separate.

FWIW I think the fix may be to move the single aui field that mdio
cares about to fbd instead of fbn ? Feels like the problem is due
to a layering violation, mdio should not be touching fbn fields.