From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2F08E31B11C for ; Fri, 5 Dec 2025 08:25:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764923131; cv=none; b=Rrpt07umRyrvtw3sJkmQvOjHQGJeUO9Kv6WA8XBsncctsfEil7AAGDUsgaIddtuVICT9ndXRvdHVkud83qXnzG5zr5x8CP6tozQdUw7kFvKaQkCTWlQxDNJDA/0q4ZQa5QuadOHCxHzETe3q+I5x69gVdSdLLSUtmpRqFdScWEA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764923131; c=relaxed/simple; bh=b7E6WBe+Fu0Qz9A8vGHqpx4aMMH5NUrSA7NG4EtSYDY=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=VArCZ7fat+B8Kxf2T+bBP5Phbm1SQ0WNUjSgVyFIwNu6xu7Tg3KJe09yWIxGR7/zYZ0g23X0LO7/xgXlLzzlyvdeVu0wgQu8qB1H4DkYJI+fqHCgNZEJJMVYBhGzG+lCdGv+bY1tn2Xh7hHdYIKiIzo6hs32nWJZd/71Iu8Q1Gk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (4096-bit key) header.d=canonical.com header.i=@canonical.com header.b=n7048Vox; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (4096-bit key) header.d=canonical.com header.i=@canonical.com header.b="n7048Vox" Received: from mail-pl1-f197.google.com (mail-pl1-f197.google.com [209.85.214.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 34F6D401BD for ; Fri, 5 Dec 2025 08:25:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1764923114; bh=8T0UHhzai2fWCo6tRGyMn8d6SwcVbZ4Ka0x+SCnjr+g=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=n7048VoxDjcpoyfzWChohsDTWQosrEVkSZ13oAQ/vlDNguhcRo9Z53pRX8cGGoDe8 8LSjCrYFcVrzpBaA1M23yTC2evNJd0vO4qBNNZ00wkn3QEIBqKgm9iMELtPDP1EGtb vToN5mN7y1LPSURhE7mA/5kD80dq0YDtWxcrB6+XZ0dTcwPDirdfSfwYS62IkfOuc7 y7ei0nse/GTQ4rek9gUbacLC+xlt2XiiujUD66Q/yeZ06OF1ra4z2E1rl35b7yPmuQ P1z4pgv9ZBaygZ+sRFoVvpR0TBkSRL7Hr3f4ttkcwjyQs573Nt8WZTWGEinks34Wm2 VNYk+Z0lPYWOqfjZRaOisqmr6b5TXCbSlI7R6SrCLVStii+QL60IJ93fG1EXM6NQsX GJTrLep/hIUy4Tiqb6HEaE+2UYiHtjhPzQY3yoL6bcLeifrS762dE+HccU495U6f6u dhBvdZZ0pUKzOx7uRjEq+Jk/g6x0ItWJZxiNMqEfwOmOFXfbA0ZhfokfeuIqPqjx0C BE6ffxyV6GyvzEK7qeddDtpvuKokCpfm5BROnrDox88qtC+HBpGWp0nrvCgoA5zPyq OxgIjvKQk4asCDR8hFUy6gCytSXHOjHOwaEx6OxcVC53TriFf+pep71AqFk3suKtRz wbVxOhAyLWTP7iwQTy7bZDjs= Received: by mail-pl1-f197.google.com with SMTP id d9443c01a7336-2956cdcdc17so20371845ad.3 for ; Fri, 05 Dec 2025 00:25:14 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764923112; x=1765527912; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=8T0UHhzai2fWCo6tRGyMn8d6SwcVbZ4Ka0x+SCnjr+g=; b=ok6i6oDMFv49KiUp2Nw+4JDUyCQ5yAu4nIVYpZYVvOZuOx3L44EO1woNZ1aKuDinjZ zSusQR0DkexcE+XVPGp1wcw0+bbjCCvyBbThBczrmU/fwZ0Z/HUwpoMGyWQpQ8aDOxjv JoaA+3VK+69/bc1HHMMBvDdLdnW1fFSNrN9ldnKbiDAIyHzDcbYmXilQ0lzPLaRplV5I LKoLoL43aWBEZ7qhLyuBpwQ1X5DZrYkgik8COVkWVeYeycp1ahNiYV1rr7E5QGoBthIg UpovGdD7owK1+XrcR4moAfEQvj6m5VMMIjvNXQ1aeELCpzEkEcwxDClCnUTELsdFEcxj 1ltw== X-Forwarded-Encrypted: i=1; AJvYcCUSCzvXFbveA0h2NS6gQInVvUe2yxHo+wWDcVD2mQSLxPKoRMaMdRhEC6gJNUq+YeKuMXTw4LOEGJi+ON8=@vger.kernel.org X-Gm-Message-State: AOJu0YzGuqtxV3+7NhTssdzmdYGRwTf1XWEROQHYbf2feB6HsAboEM9v 0psyNNdMLW+xd159mH7r9HylUf2opJW8nfQ7mkcsMy3a088oNuhb3po4P806TNojoMc/KH5usQm //WiJzl+QLYCGI44xGF7A4ze1WIhcTtfRQ4gUA2U+qbrAO+mSZEcN+/sViH3FtuoQVxXbXyBCT/ e0Sfi9HQ== X-Gm-Gg: ASbGncvS9mNlP8n7EYfjyvQ2da+g3obTm8++ulf2agqE2s7OezxJ/UqXVcs6dWP9mz9 SafyDInDHukwRdrJveTtqf2ztwJE4HCF5wItxz6YKrQFStiOCaTSPKnytpauXasSa/fufzcYRO+ dyDjBxJSdqx0OqJScY3lF99BCZDHWIDRMLU9iU94cnlyzN+wJOucEH5jNVfyV7KspsTlBq4PatP F8AzKNmuvesMbBwhqtlweHO4vPQZranC7hWZJMZYLkQfxA4AeMxAmkS4m3MYJV2RwerSCGltNeu yvyT9+kko/j/mpHZOIrYv9Od+1YnPBBArqJt69FhaKQuViaQtO0utAY7CiH/7VvjCXHoyKL4ntL uwtVTKqBYSeaF8IQ6loQYgUpl X-Received: by 2002:a17:903:1a2d:b0:295:bedb:8d7 with SMTP id d9443c01a7336-29d683b103fmr119060395ad.48.1764923111845; Fri, 05 Dec 2025 00:25:11 -0800 (PST) X-Google-Smtp-Source: AGHT+IESNNepcAR75GX1HTpnznXPE60phc9h2xI6LaFnX+Dw43NLPltYKyx42/JGzBrUjBoHtNzU+Q== X-Received: by 2002:a17:903:1a2d:b0:295:bedb:8d7 with SMTP id d9443c01a7336-29d683b103fmr119060085ad.48.1764923111440; Fri, 05 Dec 2025 00:25:11 -0800 (PST) Received: from localhost.localdomain ([103.155.100.4]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-29dae4cfaecsm40896875ad.27.2025.12.05.00.25.07 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 05 Dec 2025 00:25:11 -0800 (PST) From: Aaron Ma To: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/2] ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues Date: Fri, 5 Dec 2025 16:24:58 +0800 Message-ID: <20251205082459.1586143-1-aaron.ma@canonical.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes during resume from suspend when rings[q_idx]->q_vector is NULL. Tested adaptor: 60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02) Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003] SR-IOV state: both disabled and enabled can reproduce this issue. kernel version: v6.18 Reproduce steps: Bootup and execute suspend like systemctl suspend or rtcwake. Log: <1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 <1>[ 231.444052] #PF: supervisor read access in kernel mode <1>[ 231.444484] #PF: error_code(0x0000) - not-present page <6>[ 231.444913] PGD 0 P4D 0 <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 <4>[ 231.451629] PKRU: 55555554 <4>[ 231.452076] Call Trace: <4>[ 231.452549] <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.454425] pci_pm_resume+0x8c/0x140 <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 <4>[ 231.455347] dpm_run_callback+0x5f/0x160 <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 <4>[ 231.456244] device_resume+0x177/0x270 <4>[ 231.456708] dpm_resume+0x209/0x2f0 <4>[ 231.457151] dpm_resume_end+0x15/0x30 <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 <4>[ 231.458054] enter_state+0x10e/0x570 Add defensive checks for both the ring pointer and its q_vector before dereferencing, allowing the system to resume successfully even when q_vectors are unmapped. Fixes: 2a5dc090b92cf ("ice: move netif_queue_set_napi to rtnl-protected sections") Reviewed-by: Aleksandr Loktionov Signed-off-by: Aaron Ma --- V1 -> V2: add test device info. drivers/net/ethernet/intel/ice/ice_lib.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c index 15621707fbf81..9d1178bde4495 100644 --- a/drivers/net/ethernet/intel/ice/ice_lib.c +++ b/drivers/net/ethernet/intel/ice/ice_lib.c @@ -2779,11 +2779,13 @@ void ice_vsi_set_napi_queues(struct ice_vsi *vsi) ASSERT_RTNL(); ice_for_each_rxq(vsi, q_idx) - netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, + if (vsi->rx_rings[q_idx] && vsi->rx_rings[q_idx]->q_vector) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, &vsi->rx_rings[q_idx]->q_vector->napi); ice_for_each_txq(vsi, q_idx) - netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, + if (vsi->tx_rings[q_idx] && vsi->tx_rings[q_idx]->q_vector) + netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, &vsi->tx_rings[q_idx]->q_vector->napi); /* Also set the interrupt number for the NAPI */ ice_for_each_q_vector(vsi, v_idx) { -- 2.43.0