request_firmware() may enter the userspace fallback and call try_to_freeze(). Holding the devlink instance lock across that call triggers a lockdep warning and can block unregister for the duration of the firmware fallback. Drop the instance lock around firmware loading in both flash update paths. The callers hold a devlink reference, which also pins the parent device. Recheck registration after reacquiring the lock before calling into the driver. Fixes: b44cfd4f5b91 ("devlink: move request_firmware out of driver") Fixes: ed539ba614a0 ("devlink: always check if the devlink instance is registered") Reported-by: syzbot+372a7d84708b07f64d9b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=372a7d84708b07f64d9b Signed-off-by: Miguel Garcia --- net/devlink/dev.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/net/devlink/dev.c b/net/devlink/dev.c index 55959b0ff..cdbf39f19 100644 --- a/net/devlink/dev.c +++ b/net/devlink/dev.c @@ -1169,17 +1169,25 @@ int devlink_nl_flash_update_doit(struct sk_buff *skb, struct genl_info *info) nla_file_name = info->attrs[DEVLINK_ATTR_FLASH_UPDATE_FILE_NAME]; file_name = nla_data(nla_file_name); + devl_unlock(devlink); ret = request_firmware(¶ms.fw, file_name, devlink->dev); + devl_lock(devlink); if (ret) { NL_SET_ERR_MSG_ATTR(info->extack, nla_file_name, "failed to locate the requested firmware file"); return ret; } + /* The device may have been unregistered while the lock was dropped. */ + if (!devl_is_registered(devlink)) { + ret = -ENODEV; + goto out_release; + } devlink_flash_update_begin_notify(devlink); ret = devlink->ops->flash_update(devlink, ¶ms, info->extack); devlink_flash_update_end_notify(devlink); +out_release: release_firmware(params.fw); return ret; @@ -1244,15 +1252,24 @@ int devlink_compat_flash_update(struct devlink *devlink, const char *file_name) ret = -EOPNOTSUPP; goto out_unlock; } + devl_unlock(devlink); ret = request_firmware(¶ms.fw, file_name, devlink->dev); + devl_lock(devlink); if (ret) goto out_unlock; + /* The device may have been unregistered while the lock was dropped. */ + if (!devl_is_registered(devlink)) { + ret = -ENODEV; + goto out_release; + } + devlink_flash_update_begin_notify(devlink); ret = devlink->ops->flash_update(devlink, ¶ms, NULL); devlink_flash_update_end_notify(devlink); +out_release: release_firmware(params.fw); out_unlock: devl_unlock(devlink); -- 2.43.0