[PATCH net] net: macb: init workqueues before register_netdev()

[PATCH net] net: macb: init workqueues before register_netdev()

[Théo Lebrun]

register_netdev() exposes the interface to userspace which might trigger
operations like close on it. Those access the HRESP/LPI tasks and
might therefore use them uninitialised.

Fix this race by initialising both `struct work_struct` before
register_netdev().

Theoretical bugfix. The main reason for fix is to avoid future Sashiko
reports which triggers if we grow the race condition (by touching those
workqueues at open for example). The likeliness of this bug sounds
tiny, but I've not spent any time trying to reproduce it.

Fixes: c5092ba3155e ("net: macb: Convert tasklet API to new bottom half workqueue mechanism")
Cc: stable@vger.kernel.org
Reported-by: sashiko <sashiko@sashiko.dev>
Link: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260918-macb-close-v1-0-05e32ce98813%40bootlin.com
Link: https://lore.kernel.org/netdev/179010942347.2160803.5970158668197373074@kernel.org/
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
---
 drivers/net/ethernet/cadence/macb_main.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 8e5c034dc3a4..76260b97a07b 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -5968,15 +5968,15 @@ static int macb_probe(struct platform_device *pdev)
 	if (err)
 		goto err_out_unregister_mdio;
 
+	INIT_WORK(&bp->hresp_err_bh_work, macb_hresp_error_task);
+	INIT_DELAYED_WORK(&bp->tx_lpi_work, macb_tx_lpi_work_fn);
+
 	err = register_netdev(netdev);
 	if (err) {
 		dev_err(&pdev->dev, "Cannot register net device, aborting.\n");
 		goto err_out_free_tieoff;
 	}
 
-	INIT_WORK(&bp->hresp_err_bh_work, macb_hresp_error_task);
-	INIT_DELAYED_WORK(&bp->tx_lpi_work, macb_tx_lpi_work_fn);
-
 	netdev_info(netdev, "Cadence %s rev 0x%08x at 0x%08lx irq %d (%pM)\n",
 		    macb_is_gem(bp) ? "GEM" : "MACB", macb_readl(bp, MID),
 		    netdev->base_addr, netdev->irq, netdev->dev_addr);

---
base-commit: c15c41239b491c7fa380e7ffd115ba037f2d4b11
change-id: 20260925-macb-netdev-register-race-2b4125dd5645

Best regards,
--  
Théo Lebrun <theo.lebrun@bootlin.com>

Re: [PATCH net] net: macb: init workqueues before register_netdev()

[Nicolai Buchwitz]

Hi Théo

On 25.9.2026 15:15, Théo Lebrun wrote:
> register_netdev() exposes the interface to userspace which might 
> trigger
> operations like close on it. Those access the HRESP/LPI tasks and
> might therefore use them uninitialised.
> 
> Fix this race by initialising both `struct work_struct` before
> register_netdev().
> 
> Theoretical bugfix. The main reason for fix is to avoid future Sashiko
> reports which triggers if we grow the race condition (by touching those
> workqueues at open for example). The likeliness of this bug sounds
> tiny, but I've not spent any time trying to reproduce it.
> 
> Fixes: c5092ba3155e ("net: macb: Convert tasklet API to new bottom half 
> workqueue mechanism")

IMHO the "bug" was introduced in 032dc41ba6e2? But this would generate 
more
backporting without any real use. So let's keep it as is.

> [...]

Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks
Nicolai

Re: [PATCH net] net: macb: init workqueues before register_netdev()

[Théo Lebrun]

On Fri Sep 25, 2026 at 3:42 PM CEST, Nicolai Buchwitz wrote:
> On 25.9.2026 15:15, Théo Lebrun wrote:
>> register_netdev() exposes the interface to userspace which might 
>> trigger
>> operations like close on it. Those access the HRESP/LPI tasks and
>> might therefore use them uninitialised.
>> 
>> Fix this race by initialising both `struct work_struct` before
>> register_netdev().
>> 
>> Theoretical bugfix. The main reason for fix is to avoid future Sashiko
>> reports which triggers if we grow the race condition (by touching those
>> workqueues at open for example). The likeliness of this bug sounds
>> tiny, but I've not spent any time trying to reproduce it.
>> 
>> Fixes: c5092ba3155e ("net: macb: Convert tasklet API to new bottom half 
>> workqueue mechanism")
>
> IMHO the "bug" was introduced in 032dc41ba6e2? But this would generate 
> more
> backporting without any real use. So let's keep it as is.

I used this command to find the introduction of hresp_err_bh_work and
didn't notice it was only a tasklet to workqueue conversion patch.
You are correct.

   git log --oneline -Shresp_err_bh_work drivers/net/ethernet/cadence/

> Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de>

Thanks!

--
Théo Lebrun, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com