Re: [PATCH] netconsole configfs target release NULL dereference

[Breno Leitao <leitao@debian.org>]

Hello David,

On Fri, Jul 17, 2026 at 10:39:02AM +0000, David Lee wrote:
> configfs target release can call netpoll cleanup with missing netpoll state.
> 
> Mark targets as disabled before releasing their netpoll state and skip
> cleanup when no netpoll device is present. This prevents teardown races
> from reaching netpoll cleanup after nt->np.dev has already been cleared.
> 
> Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal")
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> Assisted-by: Codex:gpt-5.5
> ---
> 
> drivers/net/netconsole.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
> index 862001d..ad30e2e 100644
> --- a/drivers/net/netconsole.c
> +++ b/drivers/net/netconsole.c
> @@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt)
>  
>  static void netcons_release_dev(struct netconsole_target *nt)
>  {
> +	if (!nt->np.dev)
> +		return;

I am not sure we get here with nt->np.dev unset, otherwise it will
panic in the next lines:

netcons_release_dev() calls do_netpoll_cleanup(), which calls calls
__netpoll_cleanup() which dereferences dev, as in:

	static void __netpoll_cleanup(struct netpoll *np)
		...
		npinfo = rtnl_dereference(np->dev->npinfo);

Are you hitting this NULL pointer dereference, thus, we need the early
return above?

Thanks for the patch,
--breno