adapter->netdevs is sized by caps.max_vports in idpf_vc_core_init(), but
idpf_init_task() only creates netdevs for caps.default_num_vports. These
are separate virtchnl2 fields, so on a device that reports max_vports
larger than default_num_vports the tail of the array stays NULL, causing
a crash on reset:
echo 1 > /sys/class/net/<inf>/device/reset
BUG: KASAN: null-ptr-deref in idpf_vc_event_task+0x22a/0xa30 [idpf]
...
Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]
Call Trace:
dump_stack_lvl+0x77/0xb0
kasan_report+0xca/0x100
kasan_check_range+0x100/0x1b0
idpf_vc_event_task+0x22a/0xa30 [idpf]
process_one_work+0x917/0x1940
worker_thread+0x5a5/0xfe0
Add netdev NULL pointer check for every vport in the loop, same as the
max_vport loops in idpf_remove() and idpf_init_task().
Fixes: 2e281e1155fc ("idpf: detach and close netdevs while handling a reset")
Signed-off-by: Emil Tantilov <[email protected]>
---
drivers/net/ethernet/intel/idpf/idpf_lib.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c
b/drivers/net/ethernet/intel/idpf/idpf_lib.c
index 791ebff985072..0cdbd81b13711 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
@@ -765,6 +765,9 @@ static void idpf_detach_and_close(struct idpf_adapter
*adapter)
for (int i = 0; i < max_vports; i++) {
struct net_device *netdev = adapter->netdevs[i];
+ if (!netdev)
+ continue;
+
/* If the interface is in detached state, that means the
* previous reset was not handled successfully for this
* vport.
--
2.37.3
