[PATCH] net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

[PATCH] net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

[Kery Qi]

octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
ioq_vector. If request_irq() fails part-way, the rollback loop calls
free_irq() with dev_id set to 'oct', which does not match the original
dev_id and may leave the irqaction registered.

This can keep IRQ handlers alive while ioq_vector is later freed during
unwind/teardown, leading to a use-after-free or crash when an interrupt
fires.

Fix the error path to free IRQs with the same ioq_vector dev_id used
during request_irq().

Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt support")
Signed-off-by: Kery Qi <qikeyu2017@gmail.com>
---
 drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
index 420c3f4cf741..1d9760b4b8f4 100644
--- a/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
+++ b/drivers/net/ethernet/marvell/octeon_ep_vf/octep_vf_main.c
@@ -218,7 +218,7 @@ static int octep_vf_request_irqs(struct octep_vf_device *oct)
 ioq_irq_err:
 	while (i) {
 		--i;
-		free_irq(oct->msix_entries[i].vector, oct);
+		free_irq(oct->msix_entries[i].vector, oct->ioq_vector[i]);
 	}
 	return -1;
 }
-- 
2.34.1

Re: [PATCH] net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

[Simon Horman]

+ Maintainers

On Fri, Jan 09, 2026 at 12:42:57AM +0800, Kery Qi wrote:
> octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
> ioq_vector. If request_irq() fails part-way, the rollback loop calls
> free_irq() with dev_id set to 'oct', which does not match the original
> dev_id and may leave the irqaction registered.
> 
> This can keep IRQ handlers alive while ioq_vector is later freed during
> unwind/teardown, leading to a use-after-free or crash when an interrupt
> fires.
> 
> Fix the error path to free IRQs with the same ioq_vector dev_id used
> during request_irq().
> 
> Fixes: 1cd3b407977c ("octeon_ep_vf: add Tx/Rx processing and interrupt support")
> Signed-off-by: Kery Qi <qikeyu2017@gmail.com>

Thanks, I agree with your analysis; that the problem was introduced
by the cited commit; and the proposed fixes.

Reviewed-by: Simon Horman <horms@kernel.org>

Some notes on procedure For reference, if you post more networking fixes,
or need to spin this patch for some reason.

1. As a bug fix for code present in the net tree it should be
   targeted at that tree.

   Subject: [PATCH net] ...

2. Please include all maintainers and the patch author of the author commit.
   "./scripts/get_maintainer.pl this.patch" can with that.

3. For bug fixes, please consider the guidelines for stable submissions.
   I.e. CC; stable@vger.kernel.org

See also: https://docs.kernel.org/process/maintainer-netdev.html

Re: [PATCH] net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri,  9 Jan 2026 00:42:57 +0800 you wrote:
> octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
> ioq_vector. If request_irq() fails part-way, the rollback loop calls
> free_irq() with dev_id set to 'oct', which does not match the original
> dev_id and may leave the irqaction registered.
> 
> This can keep IRQ handlers alive while ioq_vector is later freed during
> unwind/teardown, leading to a use-after-free or crash when an interrupt
> fires.
> 
> [...]

Here is the summary with links:
  - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
    https://git.kernel.org/netdev/net/c/f93fc5d12d69

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html