> -----Original Message-----
> From: Emil Tantilov <[email protected]>
> Sent: Wednesday, November 4, 2026 12:54 AM
> To: [email protected]
> Cc: Burra, Phani R <[email protected]>; Zaremba, Larysa
> <[email protected]>; Hay, Joshua A <[email protected]>;
> [email protected]; [email protected]; [email protected]
> Subject: [PATCH iwl-net v3 2/2] idpf: skip empty netdev slots when
> detaching for a reset
> 
> adapter->netdevs is sized by caps.max_vports in idpf_vc_core_init(), but
> idpf_init_task() only creates netdevs for caps.default_num_vports. These
> are separate virtchnl2 fields, so on a device that reports max_vports
> larger than default_num_vports the tail of the array stays NULL, causing
> a crash on reset:
> echo 1 > /sys/class/net/<inf>/device/reset
> 
>   BUG: KASAN: null-ptr-deref in idpf_vc_event_task+0x22a/0xa30 [idpf]
>   ...
>   Workqueue: idpf-0000:83:00.0-vc_event idpf_vc_event_task [idpf]
>   Call Trace:
>   dump_stack_lvl+0x77/0xb0
>   kasan_report+0xca/0x100
>   kasan_check_range+0x100/0x1b0
>   idpf_vc_event_task+0x22a/0xa30 [idpf]
>   process_one_work+0x917/0x1940
>   worker_thread+0x5a5/0xfe0
> 
> Add netdev NULL pointer check for every vport in the loop, same as the
> max_vport loops in idpf_remove() and idpf_init_task().
> 
> Fixes: 2e281e1155fc ("idpf: detach and close netdevs while handling a
> reset")
> Signed-off-by: Emil Tantilov <[email protected]>
> ---
>  drivers/net/ethernet/intel/idpf/idpf_lib.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> index 791ebff98507..0cdbd81b1371 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> @@ -765,6 +765,9 @@ static void idpf_detach_and_close(struct
> idpf_adapter *adapter)
>       for (int i = 0; i < max_vports; i++) {
>               struct net_device *netdev = adapter->netdevs[i];
> 
> +             if (!netdev)
> +                     continue;
> +
>               /* If the interface is in detached state, that means the
>                * previous reset was not handled successfully for this
>                * vport.
> --
> 2.37.3

Reviewed-by: Aleksandr Loktionov <[email protected]>

Reply via email to