Re: [PATCH] soc: fsl: dpio: publish the dpaa2_io object only after it is initialised

On Mon, Sep 22, 2026, Jaidev Shastri wrote:

obj->dev is assigned after the lock is dropped, so a reader can pick the
object up and pass a NULL supplier to device_link_add(), which fails
with -EINVAL and fails the consumer's probe.

The object comes from kmalloc(), so obj->dev is not NULL but whatever
was left in that memory. We hit this on LX2160A boards as an
intermittent boot panic, with the deferred dpaa2-eth probe racing the
DPIO probes.

  Unable to handle kernel paging request at virtual address deadbeefdeadbfd7
  pc : device_link_add+0x80/0x700
  x20: deadbeefdeadbeef
  Call trace:
   device_link_add+0x80/0x700
   dpaa2_io_service_register+0x40/0x120 [fsl_mc_dpio]
   dpaa2_eth_setup_dpio+0x128/0x468 [fsl_dpaa2_eth]
   dpaa2_eth_probe+0x1dc/0x908 [fsl_dpaa2_eth]

Widening the window with an msleep(50) after the spin_unlock() makes it
panic on every boot. With this patch applied to 6.12 and the same
msleep(50) kept after the spin_unlock(), five boots in a row were clean.

Since this crashes real systems, could v2 say so in the commit message
and carry these tags so it reaches the stable kernels?

Fixes: cf9ff75d15a9 ("soc: fsl: dpio: store a backpointer to the device backing the dpaa2_io")
Fixes: 69651bd8d303 ("soc: fsl: dpio: add Net DIM integration")
Cc: stable@vger.kernel.org

Tested-by: Anthony Pighin <redacted>