The kasprintf() call in idpf_vport_intr_req_irq() can return NULL on
memory pressure, but the result is passed directly to request_irq()
without a NULL check. The IRQ core then stores this pointer as
action->name and dereferences it later from /proc/interrupts and
procfs, leading to a NULL pointer dereference.
Add a NULL check after kasprintf() and bail out with -ENOMEM.
Additionally, when request_irq() fails, request_threaded_irq() frees
the irqaction itself without taking ownership of the name string, so
the caller-allocated name is leaked. Free it on the error path only.
On the success path the name is owned by the irq action and released
later via kfree(free_irq(...)) in the cleanup loop, so it must not be
freed here.
Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport")
Cc: [email protected] # 6.7
Signed-off-by: Zhang Yunfei <[email protected]>
---
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 24b91be25676..86dedf5c1c09 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -4063,12 +4063,17 @@ static int idpf_vport_intr_req_irq(struct idpf_vport
*vport,
name = kasprintf(GFP_KERNEL, "%s-%s-%s-%d", drv_name, if_name,
vec_name, vector);
+ if (!name) {
+ err = -ENOMEM;
+ goto free_q_irqs;
+ }
err = request_irq(irq_num, idpf_vport_intr_clean_queues, 0,
name, q_vector);
if (err) {
netdev_err(vport->netdev,
"Request_irq failed, error: %d\n", err);
+ kfree(name);
goto free_q_irqs;
}
--
2.25.1
