On Fri, Jan 23, 2026 at 1:19 AM Eric Dumazet <[email protected]> wrote: > > On Fri, Jan 23, 2026 at 6:27 AM Li Li <[email protected]> wrote: > > > > rss_data->rss_key and vport->q_vector_idxs need to be nullified after > > they are freed. Checks like "if (!rss_data->rss_key)" and > > "if (!vport->q_vector_idxs)" in the code could fail if they are not > > nullified. > > > > Tested: built and booted the kernel. > > > > Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool > > operations") > > Fixes: 8a558cbda51b ("idpf: fix potential memory leak on kcalloc() failure") > > Signed-off-by: Li Li <[email protected]> > > --- > > drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c > > b/drivers/net/ethernet/intel/idpf/idpf_lib.c > > index 131a8121839bd..7af4214ec44de 100644 > > --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c > > +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c > > @@ -1308,8 +1308,10 @@ static struct idpf_vport *idpf_vport_alloc(struct > > idpf_adapter *adapter, > > > > free_rss_key: > > kfree(rss_data->rss_key); > > + rss_data->rss_key = NULL; > > free_vector_idxs: > > kfree(vport->q_vector_idxs); > > + vport->q_vector_idxs = NULL; > > vport is freed right after this line. > > vport->q_vector_idxs content is not relevant. > > If anything tries to deref vport->any_field ater at this point, there > is another bug. KASAN might help.
Thank you Eric! I realized this after this patch and have sent out a v2 patch with this line removed as well. > > > free_vport: > > kfree(vport); > > > > -- > > 2.52.0.457.g6b5491de43-goog > >
