request_firmware() may enter the sysfs fallback and call try_to_freeze(). Devlink invokes it while holding the instance lock, causing syzbot to report: WARNING: syz-executor/... still has locks held! Firmware flash requests already name a file provided by userspace. Use request_firmware_direct() in both flash update paths so a missing file fails immediately instead of entering the sysfs fallback. This keeps the normal devlink locking intact. On systems with CONFIG_FW_LOADER_USER_HELPER_FALLBACK=y, devlink flash can no longer obtain a missing image through that fallback. Callers still receive the existing error result, and netlink users retain the extack message. Fixes: b44cfd4f5b91 ("devlink: move request_firmware out of driver") Reported-by: syzbot+372a7d84708b07f64d9b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=372a7d84708b07f64d9b Suggested-by: Jakub Kicinski Signed-off-by: Miguel Garcia --- Changes in v4: - Resend as a new thread so patchwork and CI pick up the new revision. Changes in v3: - Use request_firmware_direct() instead of dropping the devlink instance lock, as suggested by Jakub Kicinski. - Document the resulting sysfs fallback behavior. - Rebase onto net/main at bc93419130bb. Changes in v2: - Cc Jacob Keller, author of b44cfd4f5b91, as requested by Andrew Lunn. - Keep only b44cfd4f5b91 as the Fixes tag; ed539ba614a0 provides the registration check but did not introduce the locking bug. v3: https://lore.kernel.org/r/20260901123819.2035064-1-miguelgarciaroman8@gmail.com v2: https://lore.kernel.org/r/20260830111700.1799255-1-miguelgarciaroman8@gmail.com v1: https://lore.kernel.org/r/20260829142525.3900565-1-miguelgarciaroman8@gmail.com net/devlink/dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/devlink/dev.c b/net/devlink/dev.c index 55959b0ff..b85bb02a9 100644 --- a/net/devlink/dev.c +++ b/net/devlink/dev.c @@ -1169,7 +1169,7 @@ int devlink_nl_flash_update_doit(struct sk_buff *skb, struct genl_info *info) nla_file_name = info->attrs[DEVLINK_ATTR_FLASH_UPDATE_FILE_NAME]; file_name = nla_data(nla_file_name); - ret = request_firmware(¶ms.fw, file_name, devlink->dev); + ret = request_firmware_direct(¶ms.fw, file_name, devlink->dev); if (ret) { NL_SET_ERR_MSG_ATTR(info->extack, nla_file_name, "failed to locate the requested firmware file"); @@ -1245,7 +1245,7 @@ int devlink_compat_flash_update(struct devlink *devlink, const char *file_name) goto out_unlock; } - ret = request_firmware(¶ms.fw, file_name, devlink->dev); + ret = request_firmware_direct(¶ms.fw, file_name, devlink->dev); if (ret) goto out_unlock; -- 2.43.0