[PATCH] net/enic: fix possible null dereference in notify set

[PATCH] net/enic: fix possible null dereference in notify set

[Alexey Simakov]

The memset of notify_addr in vnic_dev_notify_setcmd() was performed
unconditionally before the device reset check. When the device is in
reset, vnic_dev_notify_set() skips the notification buffer allocation,
leaving notify_addr as NULL. The subsequent call to
vnic_dev_notify_setcmd() would then dereference the NULL pointer via
memset.

Move the memset inside the existing !vnic_dev_in_reset() guard where
notify_addr is guaranteed to be valid.

Fixes: 9913fbb91df0 ("enic/base: common code")
Cc: stable@dpdk.org

Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
---
 drivers/net/enic/base/vnic_dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/enic/base/vnic_dev.c b/drivers/net/enic/base/vnic_dev.c
index ba8ecc16f2..e6d34622af 100644
--- a/drivers/net/enic/base/vnic_dev.c
+++ b/drivers/net/enic/base/vnic_dev.c
@@ -964,8 +964,8 @@ int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
 	int wait = 1000;
 	int r;
 
-	memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
 	if (!vnic_dev_in_reset(vdev)) {
+		memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
 		vdev->notify = notify_addr;
 		vdev->notify_pa = notify_pa;
 	}
-- 
2.34.1

RE: [PATCH] net/enic: fix possible null dereference in notify set

[Hyong Youb Kim (hyonkim)]

> -----Original Message-----
> From: Alexey Simakov <bigalex934@gmail.com>
> Sent: Tuesday, July 7, 2026 8:20 PM
> To: John Daley (johndale) <johndale@cisco.com>; Hyong Youb Kim (hyonkim)
> <hyonkim@cisco.com>; Sujith Sankar <ssujith@cisco.com>; David Marchand
> <david.marchand@redhat.com>; Neil Horman <nhorman@tuxdriver.com>
> Cc: dev@dpdk.org; stable@dpdk.org; Alexey Simakov <bigalex934@gmail.com>
> Subject: [PATCH] net/enic: fix possible null dereference in notify set
> 
> The memset of notify_addr in vnic_dev_notify_setcmd() was performed
> unconditionally before the device reset check. When the device is in
> reset, vnic_dev_notify_set() skips the notification buffer allocation,
> leaving notify_addr as NULL. The subsequent call to
> vnic_dev_notify_setcmd() would then dereference the NULL pointer via
> memset.
> 
> Move the memset inside the existing !vnic_dev_in_reset() guard where
> notify_addr is guaranteed to be valid.
> 
> Fixes: 9913fbb91df0 ("enic/base: common code")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
> ---
>  drivers/net/enic/base/vnic_dev.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/enic/base/vnic_dev.c b/drivers/net/enic/base/vnic_dev.c
> index ba8ecc16f2..e6d34622af 100644
> --- a/drivers/net/enic/base/vnic_dev.c
> +++ b/drivers/net/enic/base/vnic_dev.c
> @@ -964,8 +964,8 @@ int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
>  	int wait = 1000;
>  	int r;
> 
> -	memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
>  	if (!vnic_dev_in_reset(vdev)) {
> +		memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
>  		vdev->notify = notify_addr;
>  		vdev->notify_pa = notify_pa;

notify_addr == NULL (or bogus notify_pa) is a hard program error in
this function. Debug assertion might be more appropriate to make the
intention clear.

During init, the driver allocates the notify buffer while in_reset == 0.
enic_dev_init() does not check the return code from vnic_dev_notify_set().
I think that needs to be fixed.

Thanks.
-Hyong

>  	}
> --
> 2.34.1