diff options
| author | Miguel Garcia <miguelgarciaroman8@gmail.com> | 2026-09-02 11:57:30 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-03 17:11:37 -0700 |
| commit | 94284e5442bac57a33da5dd48549eb5ec803fa97 (patch) | |
| tree | b4fe414ad8f4e5a0feffd50603d4ba16d806f66d /net/devlink/dev.c | |
| parent | d5f5853f167fe2e584be013e111d03c1207969fe (diff) | |
| download | linux-94284e5442bac57a33da5dd48549eb5ec803fa97.tar.gz linux-94284e5442bac57a33da5dd48549eb5ec803fa97.zip | |
devlink: use direct firmware requests for flash updates
request_firmware() may enter the sysfs fallback and call
try_to_freeze(). Devlink invokes it while holding the instance lock,
causing syzbot to report:
WARNING: syz-executor/... still has locks held!
Firmware flash requests already name a file provided by userspace.
Use request_firmware_direct() in both flash update paths so a missing
file fails immediately instead of entering the sysfs fallback. This
keeps the normal devlink locking intact.
On systems with CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y, devlink flash
can no longer obtain a missing image through that fallback. Callers still
receive the existing error result, and netlink users retain the extack
message.
Cc: stable+noautosel@kernel.org # FW_LOADER_USER_HELPER_FALLBACK=y has no known use
Reported-by: syzbot+372a7d84708b07f64d9b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=372a7d84708b07f64d9b
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Miguel Garcia <miguelgarciaroman8@gmail.com>
Link: https://patch.msgid.link/20260902095739.3587287-1-miguelgarciaroman8@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/devlink/dev.c')
| -rw-r--r-- | net/devlink/dev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/devlink/dev.c b/net/devlink/dev.c index 55959b0ff5ab..b85bb02a9e80 100644 --- a/net/devlink/dev.c +++ b/net/devlink/dev.c @@ -1169,7 +1169,7 @@ int devlink_nl_flash_update_doit(struct sk_buff *skb, struct genl_info *info) nla_file_name = info->attrs[DEVLINK_ATTR_FLASH_UPDATE_FILE_NAME]; file_name = nla_data(nla_file_name); - ret = request_firmware(¶ms.fw, file_name, devlink->dev); + ret = request_firmware_direct(¶ms.fw, file_name, devlink->dev); if (ret) { NL_SET_ERR_MSG_ATTR(info->extack, nla_file_name, "failed to locate the requested firmware file"); @@ -1245,7 +1245,7 @@ int devlink_compat_flash_update(struct devlink *devlink, const char *file_name) goto out_unlock; } - ret = request_firmware(¶ms.fw, file_name, devlink->dev); + ret = request_firmware_direct(¶ms.fw, file_name, devlink->dev); if (ret) goto out_unlock; |