[PATCH] netconsole configfs target release NULL dereference

[David Lee <david.lee@trailofbits.com>]

configfs target release can call netpoll cleanup with missing netpoll state.

Mark targets as disabled before releasing their netpoll state and skip
cleanup when no netpoll device is present. This prevents teardown races
from reaching netpoll cleanup after nt->np.dev has already been cleared.

Fixes: 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal")
Signed-off-by: David Lee <david.lee@trailofbits.com>
Assisted-by: Codex:gpt-5.5
---

drivers/net/netconsole.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 862001d..ad30e2e 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -287,6 +287,8 @@ static bool bound_by_mac(struct netconsole_target *nt)
 
 static void netcons_release_dev(struct netconsole_target *nt)
 {
+	if (!nt->np.dev)
+		return;
 	do_netpoll_cleanup(&nt->np);
 	if (bound_by_mac(nt))
 		memset(&nt->np.dev_name, 0, IFNAMSIZ);
@@ -1490,10 +1492,12 @@ static void drop_netconsole_target(struct config_group *group,
 	 */
 	needs_cleanup = nt->state == STATE_ENABLED ||
 			nt->state == STATE_DEACTIVATED;
-	/* Disable deactivated target to prevent races between resume attempt
-	 * and target removal.
+	/* Disable targets that still own netpoll state before removal. This
+	 * prevents races between open configfs writers, resume attempts, and
+	 * target removal from observing STATE_ENABLED after netpoll_cleanup()
+	 * has cleared nt->np.dev.
 	 */
-	if (nt->state == STATE_DEACTIVATED)
+	if (needs_cleanup)
 		nt->state = STATE_DISABLED;
 	list_del(&nt->list);
 	spin_unlock_irqrestore(&target_list_lock, flags);