From b426c7a4770e25e12574647669620cb3eca4df83 Mon Sep 17 00:00:00 2001
From: dujunbao <14829755+du-junbao@user.noreply.gitee.com>
Date: Tue, 22 Sep 2026 21:13:52 +0800
Subject: [PATCH] urma: ubcore: undo the old jetty binding when the driver
 rejects the update

ubcore_set_jetty_opt() drops the software reference of the binding being
replaced with ubcore_jetty_opt_put_old() before it hands the request to the
driver: it decrements the use_cnt of the JFC/JFR bound to the jetty, or
removes the jetty from its JTG.

If dev->ops->set_jetty_opt() fails, the function returns the driver error
without restoring that reference, while jetty_cfg still points at the old
object and the hardware is unchanged. The JFC/JFR keeps a use_cnt one
lower than the number of jetties actually bound to it.

Since ubcore_delete_jfc()/ubcore_delete_jfr() refuse to destroy an object
whose use_cnt is not zero, a failed binding update lets userspace delete a
JFC/JFR that a jetty is still bound to. ubcore_free_jetty() then runs
atomic_dec(&recv_jfc->use_cnt) on the freed object, and the jetty keeps
reading a stale recv_jfc/jfr pointer.

ubcore_set_options_common() failure at the end of the same function already
restores the old binding through ubcore_jetty_opt_rollback_old(); apply the
same rollback when the driver call fails.

Fixes: 420d817c1564 ("urma: Kernel-mode specific implementations file for Jetty extension interface")
---
 drivers/ub/urma/ubcore/ubcore_jetty.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/ub/urma/ubcore/ubcore_jetty.c b/drivers/ub/urma/ubcore/ubcore_jetty.c
index 2737fbd109ec..ff4e57aba634 100644
--- a/drivers/ub/urma/ubcore/ubcore_jetty.c
+++ b/drivers/ub/urma/ubcore/ubcore_jetty.c
@@ -3711,6 +3711,7 @@ int ubcore_set_jetty_opt(struct ubcore_jetty *jetty, uint64_t opt, void *buf, ui
 	if (ret != 0) {
 		ubcore_log_err("[DRV_ERROR]Failed to set_jetty_opt, id:%u, ret %d, opt %llu.\n",
 			jetty->jetty_id.id, ret, opt);
+		ubcore_jetty_opt_rollback_old(jetty, opt);
 		return ret;
 	}
 	ret = ubcore_set_options_common(g_ubcore_jetty_opt_table,
-- 
Gitee