[PATCH] bnxt_en: Fix NULL pointer dereference

[PATCH] bnxt_en: Fix NULL pointer dereference

[Kyle Meyer]

PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 008c34cff7b4..ec38a0a40875 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -5748,7 +5748,7 @@ static void bnxt_disable_int_sync(struct bnxt *bp)
 {
 	int i;
 
-	if (!bp->irq_tbl)
+	if (!bp->irq_tbl || !bp->bnapi)
 		return;
 
 	atomic_inc(&bp->intr_sem);
-- 
2.51.0

Re: [PATCH] bnxt_en: Fix NULL pointer dereference

[Pavan Chebbi]

On Sat, Jun 6, 2026 at 3:55 AM Kyle Meyer <kyle.meyer@hpe.com> wrote:
>
> PCIe errors detected by a Root Port or Downstream Port cause error
> recovery services to run on all subordinate devices regardless of
> administrative state.
>
> The .error_detected() callback, bnxt_io_error_detected(), disables
> and synchronizes IRQs via bnxt_disable_int_sync(), which calls
> bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
> bp->bnapi.
>
> Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
> error recovery on a closed NIC can dereference a NULL pointer.
>
> Check if bp->bnapi is NULL before disabling and synchronizing IRQs.
>
> Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
> ---
>  drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>

LGTM. Thanks.
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>

> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> index 008c34cff7b4..ec38a0a40875 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
> @@ -5748,7 +5748,7 @@ static void bnxt_disable_int_sync(struct bnxt *bp)
>  {
>         int i;
>
> -       if (!bp->irq_tbl)
> +       if (!bp->irq_tbl || !bp->bnapi)
>                 return;
>
>         atomic_inc(&bp->intr_sem);
> --
> 2.51.0
>