[PATCH] net: rtase: Fix NULL pointer dereference in NAPI cleanup on probe failure

[Yang Zi <2959243019@qq.com>]

rtase_init_napi() (which adds the NAPI contexts and sets napi->dev) is
called after rtase_alloc_interrupt().  If interrupt allocation fails,
rtase_init_one() jumps to err_out_del_napi and calls netif_napi_del() on
NAPI contexts that were never added, so napi->dev is still NULL.
netif_napi_del() -> __netif_napi_del() -> netdev_lock(napi->dev)
dereferences that NULL pointer.

KASAN report:

    BUG: KASAN: null-ptr-deref in __mutex_lock_common kernel/locking/mutex.c:625 [inline]
    BUG: KASAN: null-ptr-deref in __mutex_lock+0x8f/0xce0 kernel/locking/mutex.c:820
    Read of size 8 at addr 0000000000000cd8 by task syz.0.1/1147

    __mutex_lock+0x8f/0xce0 kernel/locking/mutex.c:820
    netdev_lock include/linux/netdevice.h:2818 [inline] [rtase]
    __netif_napi_del include/linux/netdevice.h:2942 [inline] [rtase]
    netif_napi_del include/linux/netdevice.h:2961 [inline] [rtase]
    rtase_init_one+0x5c3d/0x5fd0 drivers/net/ethernet/realtek/rtase/rtase_main.c:2295 [rtase]

Only call netif_napi_del() on NAPI contexts that were actually added
(napi->dev != NULL), so the interrupt-allocation failure path skips them
while the post-napi-init failure paths still remove them.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
 drivers/net/ethernet/realtek/rtase/rtase_main.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/realtek/rtase/rtase_main.c b/drivers/net/ethernet/realtek/rtase/rtase_main.c
index e3cd4f7c1380..b4d8828ca87d 100644
--- a/drivers/net/ethernet/realtek/rtase/rtase_main.c
+++ b/drivers/net/ethernet/realtek/rtase/rtase_main.c
@@ -2493,9 +2493,14 @@ static int rtase_init_one(struct pci_dev *pdev,
     }
 
 err_out_del_napi:
+    /* rtase_init_napi() runs after rtase_alloc_interrupt(); if interrupt
+     * allocation failed the NAPI contexts were never added and napi->dev is
+     * still NULL, so netif_napi_del() must not be called on them.
+     */
     for (i = 0; i < tp->int_nums; i++) {
         ivec = &tp->int_vector[i];
-        netif_napi_del(&ivec->napi);
+        if (ivec->napi.dev)
+            netif_napi_del(&ivec->napi);
     }
 
 err_out_release_board: