> -----Original Message-----
> From: Michal Schmidt <[email protected]>
> Sent: Friday, March 13, 2026 9:22 AM
> To: Nguyen, Anthony L <[email protected]>; Kitszel,
> Przemyslaw <[email protected]>; Andrew Lunn
> <[email protected]>; David S. Miller <[email protected]>; Eric
> Dumazet <[email protected]>; Jakub Kicinski <[email protected]>; Paolo
> Abeni <[email protected]>; Keller, Jacob E <[email protected]>;
> Loktionov, Aleksandr <[email protected]>; Jagielski,
> Jedrzej <[email protected]>
> Cc: Xiaoqiang Xiong <[email protected]>; intel-wired-
> [email protected]; [email protected]; linux-
> [email protected]
> Subject: [PATCH iwl-net] ixgbevf: add missing negotiate_features op to
> Hyper-V ops table
>
> Commit a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by
> negotiating supported features") added the .negotiate_features
> callback to ixgbe_mac_operations and populated it in ixgbevf_mac_ops,
> but forgot to add it to ixgbevf_hv_mac_ops. This leaves the function
> pointer NULL on Hyper-V VMs.
>
> During probe, ixgbevf_negotiate_api() calls ixgbevf_set_features(),
> which unconditionally dereferences hw->mac.ops.negotiate_features().
> On Hyper-V this results in a NULL pointer dereference:
>
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> [...]
> Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine
> [...]
> Workqueue: events work_for_cpu_fn
> RIP: 0010:0x0
> [...]
> Call Trace:
> ixgbevf_negotiate_api+0x66/0x160 [ixgbevf]
> ixgbevf_sw_init+0xe4/0x1f0 [ixgbevf]
> ixgbevf_probe+0x20f/0x4a0 [ixgbevf]
> local_pci_probe+0x50/0xa0
> work_for_cpu_fn+0x1a/0x30
> [...]
>
> Add ixgbevf_hv_negotiate_features_vf() that returns -EOPNOTSUPP and
> wire it into ixgbevf_hv_mac_ops. The caller already handles -
> EOPNOTSUPP gracefully.
>
> Fixes: a7075f501bd3 ("ixgbevf: fix mailbox API compatibility by
> negotiating supported features")
> Reported-by: Xiaoqiang Xiong <[email protected]>
> Closes: https://issues.redhat.com/browse/RHEL-155455
> Assisted-by: Claude:claude-4.6-opus-high Cursor
> Tested-by: Xiaoqiang Xiong <[email protected]>
> Signed-off-by: Michal Schmidt <[email protected]>
> ---
> drivers/net/ethernet/intel/ixgbevf/vf.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbevf/vf.c
> b/drivers/net/ethernet/intel/ixgbevf/vf.c
> index b67b580f7f1c..f6df86d124b9 100644
> --- a/drivers/net/ethernet/intel/ixgbevf/vf.c
> +++ b/drivers/net/ethernet/intel/ixgbevf/vf.c
> @@ -709,6 +709,12 @@ static int ixgbevf_negotiate_features_vf(struct
> ixgbe_hw *hw, u32 *pf_features)
> return err;
> }
>
> +static int ixgbevf_hv_negotiate_features_vf(struct ixgbe_hw *hw,
> + u32 *pf_features)
> +{
> + return -EOPNOTSUPP;
> +}
> +
> /**
> * ixgbevf_set_vfta_vf - Set/Unset VLAN filter table address
> * @hw: pointer to the HW structure
> @@ -1142,6 +1148,7 @@ static const struct ixgbe_mac_operations
> ixgbevf_hv_mac_ops = {
> .setup_link = ixgbevf_setup_mac_link_vf,
> .check_link = ixgbevf_hv_check_mac_link_vf,
> .negotiate_api_version =
> ixgbevf_hv_negotiate_api_version_vf,
> + .negotiate_features = ixgbevf_hv_negotiate_features_vf,
> .set_rar = ixgbevf_hv_set_rar_vf,
> .update_mc_addr_list = ixgbevf_hv_update_mc_addr_list_vf,
> .update_xcast_mode = ixgbevf_hv_update_xcast_mode,
> --
> 2.53.0
Reviewed-by: Aleksandr Loktionov <[email protected]>
