[Intel-wired-lan] [PATCH iwl-net] idpf: clear stale cdev_info ptr

[Intel-wired-lan] [PATCH iwl-net] idpf: clear stale cdev_info ptr

[Joshua Hay]

Deinit calls idpf_idc_deinit_core_aux_device to free the cdev_info
memory, but leaves the adapter->cdev_info field with a stale pointer
value. This will bypass subsequent "if (!cdev_info)" checks if cdev_info
is not reallocated. For example, if idc_init fails after a reset,
cdev_info will already have been freed during the reset handling, but it
will not have been reallocated. The next reset or rmmod will result in a
crash.

[  +0.000008] BUG: kernel NULL pointer dereference, address: 00000000000000d0
[  +0.000033] #PF: supervisor read access in kernel mode
[  +0.000020] #PF: error_code(0x0000) - not-present page
[  +0.000017] PGD 2097dfa067 P4D 0
[  +0.000017] Oops: Oops: 0000 [#1] SMP NOPTI
...
[  +0.000018] RIP: 0010:device_del+0x3e/0x3d0
[  +0.000010] Call Trace:
[  +0.000010]  <TASK>
[  +0.000012]  idpf_idc_deinit_core_aux_device+0x36/0x70 [idpf]
[  +0.000034]  idpf_vc_core_deinit+0x3e/0x180 [idpf]
[  +0.000035]  idpf_remove+0x40/0x1d0 [idpf]
[  +0.000035]  pci_device_remove+0x42/0xb0
[  +0.000020]  device_release_driver_internal+0x19c/0x200
[  +0.000024]  driver_detach+0x48/0x90
[  +0.000018]  bus_remove_driver+0x6d/0x100
[  +0.000023]  pci_unregister_driver+0x2e/0xb0
[  +0.000022]  __do_sys_delete_module.isra.0+0x18c/0x2b0
[  +0.000025]  ? kmem_cache_free+0x2c2/0x390
[  +0.000023]  do_syscall_64+0x107/0x7d0
[  +0.000023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e

Pass the adapter struct into idpf_idc_deinit_core_aux_device instead and
clear the cdev_info ptr.

Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy")
Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
---
 drivers/net/ethernet/intel/idpf/idpf.h          | 2 +-
 drivers/net/ethernet/intel/idpf/idpf_idc.c      | 6 ++++--
 drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 2 +-
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf.h b/drivers/net/ethernet/intel/idpf/idpf.h
index b206fba092c8..ec1b75f039bb 100644
--- a/drivers/net/ethernet/intel/idpf/idpf.h
+++ b/drivers/net/ethernet/intel/idpf/idpf.h
@@ -1066,7 +1066,7 @@ bool idpf_vport_set_hsplit(const struct idpf_vport *vport, u8 val);
 int idpf_idc_init(struct idpf_adapter *adapter);
 int idpf_idc_init_aux_core_dev(struct idpf_adapter *adapter,
 			       enum iidc_function_type ftype);
-void idpf_idc_deinit_core_aux_device(struct iidc_rdma_core_dev_info *cdev_info);
+void idpf_idc_deinit_core_aux_device(struct idpf_adapter *adapter);
 void idpf_idc_deinit_vport_aux_device(struct iidc_rdma_vport_dev_info *vdev_info);
 void idpf_idc_issue_reset_event(struct iidc_rdma_core_dev_info *cdev_info);
 void idpf_idc_vdev_mtu_event(struct iidc_rdma_vport_dev_info *vdev_info,
diff --git a/drivers/net/ethernet/intel/idpf/idpf_idc.c b/drivers/net/ethernet/intel/idpf/idpf_idc.c
index bd4785fb8d3e..7e4f4ac92653 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_idc.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_idc.c
@@ -470,10 +470,11 @@ int idpf_idc_init_aux_core_dev(struct idpf_adapter *adapter,
 
 /**
  * idpf_idc_deinit_core_aux_device - de-initialize Auxiliary Device(s)
- * @cdev_info: IDC core device info pointer
+ * @adapter: driver private data structure
  */
-void idpf_idc_deinit_core_aux_device(struct iidc_rdma_core_dev_info *cdev_info)
+void idpf_idc_deinit_core_aux_device(struct idpf_adapter *adapter)
 {
+	struct iidc_rdma_core_dev_info *cdev_info = adapter->cdev_info;
 	struct iidc_rdma_priv_dev_info *privd;
 
 	if (!cdev_info)
@@ -485,6 +486,7 @@ void idpf_idc_deinit_core_aux_device(struct iidc_rdma_core_dev_info *cdev_info)
 	kfree(privd->mapped_mem_regions);
 	kfree(privd);
 	kfree(cdev_info);
+	adapter->cdev_info = NULL;
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index d5a877e1fef8..113ecfc16dd7 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -3668,7 +3668,7 @@ void idpf_vc_core_deinit(struct idpf_adapter *adapter)
 
 	idpf_ptp_release(adapter);
 	idpf_deinit_task(adapter);
-	idpf_idc_deinit_core_aux_device(adapter->cdev_info);
+	idpf_idc_deinit_core_aux_device(adapter);
 	idpf_rel_rx_pt_lkup(adapter);
 	idpf_intr_rel(adapter);
 
-- 
2.39.2

Re: [Intel-wired-lan] [PATCH iwl-net] idpf: clear stale cdev_info ptr

[Simon Horman]

On Mon, Mar 02, 2026 at 05:28:31PM -0800, Joshua Hay wrote:
> Deinit calls idpf_idc_deinit_core_aux_device to free the cdev_info
> memory, but leaves the adapter->cdev_info field with a stale pointer
> value. This will bypass subsequent "if (!cdev_info)" checks if cdev_info
> is not reallocated. For example, if idc_init fails after a reset,
> cdev_info will already have been freed during the reset handling, but it
> will not have been reallocated. The next reset or rmmod will result in a
> crash.
> 
> [  +0.000008] BUG: kernel NULL pointer dereference, address: 00000000000000d0
> [  +0.000033] #PF: supervisor read access in kernel mode
> [  +0.000020] #PF: error_code(0x0000) - not-present page
> [  +0.000017] PGD 2097dfa067 P4D 0
> [  +0.000017] Oops: Oops: 0000 [#1] SMP NOPTI
> ...
> [  +0.000018] RIP: 0010:device_del+0x3e/0x3d0
> [  +0.000010] Call Trace:
> [  +0.000010]  <TASK>
> [  +0.000012]  idpf_idc_deinit_core_aux_device+0x36/0x70 [idpf]
> [  +0.000034]  idpf_vc_core_deinit+0x3e/0x180 [idpf]
> [  +0.000035]  idpf_remove+0x40/0x1d0 [idpf]
> [  +0.000035]  pci_device_remove+0x42/0xb0
> [  +0.000020]  device_release_driver_internal+0x19c/0x200
> [  +0.000024]  driver_detach+0x48/0x90
> [  +0.000018]  bus_remove_driver+0x6d/0x100
> [  +0.000023]  pci_unregister_driver+0x2e/0xb0
> [  +0.000022]  __do_sys_delete_module.isra.0+0x18c/0x2b0
> [  +0.000025]  ? kmem_cache_free+0x2c2/0x390
> [  +0.000023]  do_syscall_64+0x107/0x7d0
> [  +0.000023]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> 
> Pass the adapter struct into idpf_idc_deinit_core_aux_device instead and
> clear the cdev_info ptr.
> 
> Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy")
> Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

Reviewed-by: Simon Horman <horms@kernel.org>

RE: [Intel-wired-lan] [PATCH iwl-net] idpf: clear stale cdev_info ptr

[Salin, Samuel]

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
> Simon Horman
> Sent: Thursday, March 5, 2026 1:31 AM
> To: Hay, Joshua A <joshua.a.hay@intel.com>
> Cc: intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; Kitszel,
> Przemyslaw <przemyslaw.kitszel@intel.com>; Loktionov, Aleksandr
> <aleksandr.loktionov@intel.com>
> Subject: Re: [Intel-wired-lan] [PATCH iwl-net] idpf: clear stale cdev_info ptr
> 
> On Mon, Mar 02, 2026 at 05:28:31PM -0800, Joshua Hay wrote:
> > Deinit calls idpf_idc_deinit_core_aux_device to free the cdev_info
> > memory, but leaves the adapter->cdev_info field with a stale pointer
> > value. This will bypass subsequent "if (!cdev_info)" checks if
> > cdev_info is not reallocated. For example, if idc_init fails after a
> > reset, cdev_info will already have been freed during the reset
> > handling, but it will not have been reallocated. The next reset or
> > rmmod will result in a crash.
> >
> > [  +0.000008] BUG: kernel NULL pointer dereference, address:
> > 00000000000000d0 [  +0.000033] #PF: supervisor read access in kernel
> > mode [  +0.000020] #PF: error_code(0x0000) - not-present page [
> > +0.000017] PGD 2097dfa067 P4D 0 [  +0.000017] Oops: Oops: 0000 [#1]
> > SMP NOPTI ...
> > [  +0.000018] RIP: 0010:device_del+0x3e/0x3d0 [  +0.000010] Call
> > Trace:
> > [  +0.000010]  <TASK>
> > [  +0.000012]  idpf_idc_deinit_core_aux_device+0x36/0x70 [idpf] [
> > +0.000034]  idpf_vc_core_deinit+0x3e/0x180 [idpf] [  +0.000035]
> > idpf_remove+0x40/0x1d0 [idpf] [  +0.000035]
> > pci_device_remove+0x42/0xb0 [  +0.000020]
> > device_release_driver_internal+0x19c/0x200
> > [  +0.000024]  driver_detach+0x48/0x90 [  +0.000018]
> > bus_remove_driver+0x6d/0x100 [  +0.000023]
> > pci_unregister_driver+0x2e/0xb0 [  +0.000022]
> > __do_sys_delete_module.isra.0+0x18c/0x2b0
> > [  +0.000025]  ? kmem_cache_free+0x2c2/0x390 [  +0.000023]
> > do_syscall_64+0x107/0x7d0 [  +0.000023]
> > entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >
> > Pass the adapter struct into idpf_idc_deinit_core_aux_device instead
> > and clear the cdev_info ptr.
> >
> > Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create,
> > init, and destroy")
> > Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
> > Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
> > Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> 
> Reviewed-by: Simon Horman <horms@kernel.org>

Tested-by: Samuel Salin <Samuel.salin@intel.com>