> -----Original Message----- > From: Vincent Choiniere via B4 Relay > <[email protected]> > Sent: Monday, October 26, 2026 2:30 PM > To: Nguyen, Anthony L <[email protected]>; Kitszel, Przemyslaw > <[email protected]>; Andrew Lunn <[email protected]>; > David S. Miller <[email protected]>; Eric Dumazet > <[email protected]>; Jakub Kicinski <[email protected]>; Paolo Abeni > <[email protected]> > Cc: Michal Swiatkowski <[email protected]>; intel- > [email protected]; [email protected]; linux- > [email protected]; [email protected]; Vincent Choiniere > <[email protected]> > Subject: [PATCH iwl-net] ice: fix NULL dereference after disabling RDMA > > From: Vincent Choiniere <[email protected]> > > ice_deinit_rdma() checks ice_is_rdma_ena() before dereferencing > pf->cdev_info. While the enable_rdma devlink driverinit parameter is > registered, that helper returns the parameter value. Once the parameter > is unregistered, it falls back to ICE_FLAG_RDMA_ENA. > > When enable_rdma is set to false and applied by a devlink reload, > ice_init_rdma() returns early, leaving pf->cdev_info NULL. During driver > removal, ice_remove() calls ice_deinit_devlink() before ice_unload(). > The parameters are therefore unregistered before ice_deinit_rdma() runs. > On an RDMA-capable device, ice_is_rdma_ena() then returns true, allowing > ice_deinit_rdma() to dereference the NULL pointer. > > This can cause a panic during reboot, module removal or PCI unbind. > Reproduced on an E810 PF with Ubuntu kernel 7.0.0-14 (PREEMPT_RT): > > devlink dev param set pci/0000:02:00.0 name enable_rdma value false \ > cmode driverinit > devlink dev reload pci/0000:02:00.0 action driver_reinit systemctl > reboot > > BUG: kernel NULL pointer dereference, address: 0000000000000018 > RIP: 0010:ice_deinit_rdma+0x30/0x60 [ice] > ice_unload+0x3f/0x150 [ice] > ice_remove+0xb5/0x1d0 [ice] > ice_shutdown+0x1b/0x60 [ice] > pci_device_shutdown > device_shutdown > kernel_restart > Kernel panic - not syncing: Attempted to kill init! > > Check pf->cdev_info before dereferencing it, as > ice_rdma_update_vsi_filter() already does. This preserves the existing > enable_rdma semantics without changing other ice_is_rdma_ena() callers. > > Fixes: 87181cd6985f ("ice: enable_rdma devlink param") > Cc: [email protected] > Signed-off-by: Vincent Choiniere <[email protected]> > --- > Testing was performed on an E810 PF passed through to a KVM guest, using > Ubuntu kernel 7.0.0-38 (PREEMPT_RT). Two kernels differing only by this > patch were compared. Each test set enable_rdma=false and applied it with > devlink reload driver_reinit before the removal step. > > Removal path Without patch With patch > reboot (x3) NULL deref, panic (3/3) clean (3/3) > rmmod ice NULL deref clean > PCI unbind NULL deref clean > > Additional checks on the patched kernel: > - Reboot without a preceding devlink reload completed cleanly. > - irdma devices returned after PCI unbind/bind. > - irdma devices returned after an enable_rdma false -> true reload > cycle. > > No KASAN or kmemleak testing was performed. > > The exact target tree (net, 7076f684d5132e6a) was not built or tested. > ice_deinit_rdma() and ice_is_rdma_ena() are unchanged there compared > with the tested code. > --- > drivers/net/ethernet/intel/ice/ice_idc.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c > b/drivers/net/ethernet/intel/ice/ice_idc.c > index 102d63c30..09dfcffeb 100644 > --- a/drivers/net/ethernet/intel/ice/ice_idc.c > +++ b/drivers/net/ethernet/intel/ice/ice_idc.c > @@ -454,7 +454,7 @@ int ice_init_rdma(struct ice_pf *pf) > */ > void ice_deinit_rdma(struct ice_pf *pf) { > - if (!ice_is_rdma_ena(pf)) > + if (!ice_is_rdma_ena(pf) || !pf->cdev_info) > return; > > xa_erase(&ice_aux_id, pf->aux_idx); > > --- > base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5 > change-id: 20261025-ice-deinit-rdma-null-613f1be33f72 >
Reviewed-by: Aleksandr Loktionov <[email protected]>
