[PATCH] netconsole configfs target release NULL dereference

[PATCH] netconsole configfs target release NULL dereference

[David Lee]

configfs target release can call netpoll cleanup with missing netpoll state.

Mark targets as disabled before releasing their netpoll state and skip
cleanup when no netpoll device is present. This prevents teardown races
from reaching netpoll cleanup after nt->np.dev has already been cleared.

Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
---

drivers/net/netconsole.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 862001d..ad30e2e 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt)
 
 static void netcons_release_dev(struct netconsole_target *nt)
 {
+	if (!nt->np.dev)
+		return;
 	do_netpoll_cleanup(&nt->np);
 	if (bound_by_mac(nt))
 		memset(&nt->np.dev_name, 0, IFNAMSIZ);
@@ -1490,10 +1492,12 @@ static void drop_netconsole_target(struct config_group *group,
 	 */
 	needs_cleanup = nt->state == STATE_ENABLED ||
 			nt->state == STATE_DEACTIVATED;
-	/* Disable deactivated target to prevent races between resume attempt
-	 * and target removal.
+	/* Disable targets that still own netpoll state before removal. This
+	 * prevents races between open configfs writers, resume attempts, and
+	 * target removal from observing STATE_ENABLED after netpoll_cleanup()
+	 * has cleared nt->np.dev.
 	 */
-	if (nt->state == STATE_DEACTIVATED)
+	if (needs_cleanup)
 		nt->state = STATE_DISABLED;
 	list_del(&nt->list);
 	spin_unlock_irqrestore(&target_list_lock, flags);

Re: [PATCH] netconsole configfs target release NULL dereference

[Breno Leitao]

Hello David,

On Fri, Jul 17, 2026 at 10:39:02AM +0000, David Lee wrote:
> configfs target release can call netpoll cleanup with missing netpoll state.
> 
> Mark targets as disabled before releasing their netpoll state and skip
> cleanup when no netpoll device is present. This prevents teardown races
> from reaching netpoll cleanup after nt->np.dev has already been cleared.
> 
> Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal")
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> Assisted-by: Codex:gpt-5.5
> ---
> 
> drivers/net/netconsole.c |   10 +++++++---
>  1 file changed, 7 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
> index 862001d..ad30e2e 100644
> --- a/drivers/net/netconsole.c
> +++ b/drivers/net/netconsole.c
> @@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt)
>  
>  static void netcons_release_dev(struct netconsole_target *nt)
>  {
> +	if (!nt->np.dev)
> +		return;

I am not sure we get here with nt->np.dev unset, otherwise it will
panic in the next lines:

netcons_release_dev() calls do_netpoll_cleanup(), which calls calls
__netpoll_cleanup() which dereferences dev, as in:

	static void __netpoll_cleanup(struct netpoll *np)
		...
		npinfo = rtnl_dereference(np->dev->npinfo);

Are you hitting this NULL pointer dereference, thus, we need the early
return above?

Thanks for the patch,
--breno