From: Vincent Choiniere <[email protected]>
ice_deinit_rdma() checks ice_is_rdma_ena() before dereferencing
pf->cdev_info. While the enable_rdma devlink driverinit parameter is
registered, that helper returns the parameter value. Once the parameter
is unregistered, it falls back to ICE_FLAG_RDMA_ENA.
When enable_rdma is set to false and applied by a devlink reload,
ice_init_rdma() returns early, leaving pf->cdev_info NULL. During driver
removal, ice_remove() calls ice_deinit_devlink() before ice_unload().
The parameters are therefore unregistered before ice_deinit_rdma()
runs. On an RDMA-capable device, ice_is_rdma_ena() then returns true,
allowing ice_deinit_rdma() to dereference the NULL pointer.
This can cause a panic during reboot, module removal or PCI unbind.
Reproduced on an E810 PF with Ubuntu kernel 7.0.0-14 (PREEMPT_RT):
devlink dev param set pci/0000:02:00.0 name enable_rdma value false \
cmode driverinit
devlink dev reload pci/0000:02:00.0 action driver_reinit
systemctl reboot
BUG: kernel NULL pointer dereference, address: 0000000000000018
RIP: 0010:ice_deinit_rdma+0x30/0x60 [ice]
ice_unload+0x3f/0x150 [ice]
ice_remove+0xb5/0x1d0 [ice]
ice_shutdown+0x1b/0x60 [ice]
pci_device_shutdown
device_shutdown
kernel_restart
Kernel panic - not syncing: Attempted to kill init!
Check pf->cdev_info before dereferencing it, as
ice_rdma_update_vsi_filter() already does. This preserves the existing
enable_rdma semantics without changing other ice_is_rdma_ena() callers.
Fixes: 87181cd6985f ("ice: enable_rdma devlink param")
Cc: [email protected]
Signed-off-by: Vincent Choiniere <[email protected]>
---
Testing was performed on an E810 PF passed through to a KVM guest,
using Ubuntu kernel 7.0.0-38 (PREEMPT_RT). Two kernels differing only
by this patch were compared. Each test set enable_rdma=false and
applied it with devlink reload driver_reinit before the removal step.
Removal path Without patch With patch
reboot (x3) NULL deref, panic (3/3) clean (3/3)
rmmod ice NULL deref clean
PCI unbind NULL deref clean
Additional checks on the patched kernel:
- Reboot without a preceding devlink reload completed cleanly.
- irdma devices returned after PCI unbind/bind.
- irdma devices returned after an enable_rdma false -> true reload
cycle.
No KASAN or kmemleak testing was performed.
The exact target tree (net, 7076f684d5132e6a) was not built or tested.
ice_deinit_rdma() and ice_is_rdma_ena() are unchanged there compared
with the tested code.
---
drivers/net/ethernet/intel/ice/ice_idc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c
b/drivers/net/ethernet/intel/ice/ice_idc.c
index 102d63c30..09dfcffeb 100644
--- a/drivers/net/ethernet/intel/ice/ice_idc.c
+++ b/drivers/net/ethernet/intel/ice/ice_idc.c
@@ -454,7 +454,7 @@ int ice_init_rdma(struct ice_pf *pf)
*/
void ice_deinit_rdma(struct ice_pf *pf)
{
- if (!ice_is_rdma_ena(pf))
+ if (!ice_is_rdma_ena(pf) || !pf->cdev_info)
return;
xa_erase(&ice_aux_id, pf->aux_idx);
---
base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
change-id: 20261025-ice-deinit-rdma-null-613f1be33f72
