Message-ID: <aRsWAPW2g5_OIXhQ@soc-5CG4396X81.clients.intel.com>
Date: Mon, 17 Nov 2025 13:33:04 +0100
From: Larysa Zaremba <larysa.zaremba@...el.com>
To: Paul Menzel <pmenzel@...gen.mpg.de>
CC: Tony Nguyen <anthony.l.nguyen@...el.com>,
	<intel-wired-lan@...ts.osuosl.org>, Przemek Kitszel
	<przemyslaw.kitszel@...el.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Jakub
 Kicinski" <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, Emil Tantilov
	<emil.s.tantilov@...el.com>, Madhu Chittim <madhu.chittim@...el.com>, "Josh
 Hay" <joshua.a.hay@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH iwl-net] idpf: fix aux device
 unplugging when rdma is not supported by vport

On Mon, Nov 17, 2025 at 08:25:50AM +0100, Paul Menzel wrote:
> Dear Larysa,
> 
> 
> Thank you for your patch.
> 
> Am 17.11.25 um 08:03 schrieb Larysa Zaremba:
> > If vport flags do not contain VIRTCHNL2_VPORT_ENABLE_RDMA, driver does not
> > allocate vdev_info for this vport. This leads to kernel NULL pointer
> > dereference in idpf_idc_vport_dev_down(), which references vdev_info for
> > every vport regardless.
> 
> Please paste part of the Oops log lines.
>

[Nov17 13:01] BUG: kernel NULL pointer dereference, address: 0000000000000000
[  +0.000044] #PF: supervisor read access in kernel mode
[  +0.000023] #PF: error_code(0x0000) - not-present page
[  +0.000022] PGD 1086495067 P4D 0
[  +0.000021] Oops: Oops: 0000 [#1] SMP NOPTI
[  +0.000024] CPU: 122 UID: 0 PID: 2977 Comm: rmmod Tainted: G S                  6.18.0-rc5+ #2 PREEMPT(lazy)
[  +0.000037] Tainted: [S]=CPU_OUT_OF_SPEC
[  +0.000016] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0008.2305172341 05/17/2023
[  +0.000031] RIP: 0010:idpf_idc_vport_dev_ctrl+0x4a/0x1d0 [idpf]
[  +0.000051] Code: b7 85 62 05 00 00 40 84 f6 75 7b 31 db 66 85 c0 74 61 48 8b 85 28 05 00 00 4c 8b 24 d8 4d 85 e4 74 42 49 8b 84 24 80 00 00 00 <4c> 8b 28 4d 85 ed 74 2b 41 8b b5 00 03 00 00 48 c7 c7 90 df 1f c1
[  +0.000053] RSP: 0018:ff8a55d0221d7da0 EFLAGS: 00010286
[  +0.000022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffa10e7c0f
[  +0.000024] RDX: 000000007ffffffe RSI: 0000000000000000 RDI: ff39dab073e381a0
[  +0.000023] RBP: ff39dab04dc50000 R08: ff39daa0c08f0918 R09: ff39dab08372b7b0
[  +0.000022] R10: ff39dab06fdbd778 R11: 0000000000000000 R12: ff39dab061fba800
[  +0.000023] R13: ff39dab06b2f4480 R14: ff39daa0caeae148 R15: 0000000000000000
[  +0.000024] FS:  00007f53a027d740(0000) GS:ff39dac05ceca000(0000) knlGS:0000000000000000
[  +0.000026] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000021] CR2: 0000000000000000 CR3: 00000010acc48006 CR4: 0000000000771ef0
[  +0.000024] PKRU: 55555554
[  +0.000014] Call Trace:
[  +0.000016]  <TASK>
[  +0.000019]  ig3rdma_core_remove+0x1c/0x60 [irdma]
[  +0.000091]  device_release_driver_internal+0x19f/0x200
[  +0.000035]  driver_detach+0x48/0x90
[  +0.000022]  bus_remove_driver+0x6d/0xf0
[  +0.000022]  auxiliary_driver_unregister+0x16/0x20
[  +0.000027]  irdma_exit_module+0x58/0x64 [irdma]
[  +0.000087]  __do_sys_delete_module.isra.0+0x1b9/0x310
[  +0.000036]  do_syscall_64+0x84/0x810
[  +0.000024]  ? clear_bhb_loop+0x50/0xa0
[  +0.000025]  ? clear_bhb_loop+0x50/0xa0
[  +0.000022]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  +0.000024] RIP: 0033:0x7f539fb34abb
[  +0.000058] Code: 73 01 c3 48 8b 0d 55 13 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 25 13 0c 00 f7 d8 64 89 01 48
[  +0.000064] RSP: 002b:00007ffd969dee68 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[  +0.000032] RAX: ffffffffffffffda RBX: 00005634554d36f0 RCX: 00007f539fb34abb
[  +0.000028] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005634554d3758
[  +0.000028] RBP: 00007ffd969dee90 R08: 1999999999999999 R09: 0000000000000000
[  +0.000027] R10: 00007f539fba5ac0 R11: 0000000000000206 R12: 0000000000000000
[  +0.000779] R13: 00007ffd969df0f0 R14: 00005634554d36f0 R15: 0000000000000000
[  +0.000716]  </TASK>
[  +0.000698] Modules linked in: irdma(-) i40e ice gnss ib_uverbs libie libie_adminq libie_fwlog ib_core idpf libeth_xdp rfkill qrtr sunrpc intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common i10nm_edac skx_edac_common nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp dax_hmem cxl_acpi cxl_port coretemp iTCO_wdt spi_nor rapl intel_pmc_bxt cxl_core ipmi_ssif intel_cstate intel_th_gth mtd iTCO_vendor_support mei_me isst_if_mbox_pci fwctl intel_th_pci isst_if_mmio vfat fat intel_uncore einj pcspkr i2c_i801 spi_intel_pci mei ioatdma intel_vsec isst_if_common spi_intel intel_th i2c_smbus intel_pch_thermal dca acpi_power_meter ipmi_si acpi_ipmi joydev ipmi_devintf ipmi_msghandler acpi_pad fuse loop zram lz4hc_compress lz4_compress xfs nvme nvme_core bnxt_en ixd nvme_keyring ast libie_pci nvme_auth polyval_clmulni libie_cp ghash_clmulni_intel hkdf libeth i2c_algo_bit wmi scsi_dh_rdac scsi_dh_emc scsi_dh_alua dm_multipath
[  +0.006464] CR2: 0000000000000000
[  +0.000823] ---[ end trace 0000000000000000 ]---

> > Check, if vdev_info was ever allocated before unplugging aux device.
> 
> Please describe your test system.
>

Ethernet controller: Intel Corporation Infrastructure Data Path Function (rev 21)

MEV-TS card with FW v2.0.5.

> > Fixes: be91128c579c ("idpf: implement RDMA vport auxiliary dev create, init, and destroy")
> > Reviewed-by: Madhu Chittim <madhu.chittim@...el.com>
> > Signed-off-by: Larysa Zaremba <larysa.zaremba@...el.com>
> > ---
> >   drivers/net/ethernet/intel/idpf/idpf_idc.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/ethernet/intel/idpf/idpf_idc.c b/drivers/net/ethernet/intel/idpf/idpf_idc.c
> > index c1b963f6bfad..4b1037eb2623 100644
> > --- a/drivers/net/ethernet/intel/idpf/idpf_idc.c
> > +++ b/drivers/net/ethernet/intel/idpf/idpf_idc.c
> > @@ -322,7 +322,7 @@ static void idpf_idc_vport_dev_down(struct idpf_adapter *adapter)
> >   	for (i = 0; i < adapter->num_alloc_vports; i++) {
> >   		struct idpf_vport *vport = adapter->vports[i];
> > -		if (!vport)
> > +		if (!vport || !vport->vdev_info)
> >   			continue;
> >   		idpf_unplug_aux_dev(vport->vdev_info->adev);
> 
> The diff looks good.
> 
> Reviewed-by: Paul Menzel <pmenzel@...gen.mpg.de>
> 
> 
> Kind regards,
> 
> Paul

Powered by blists - more mailing lists