netdev - Re: [PATCH iwl-net v2 3/3] idpf: Fix RSS LUT NULL ptr issue after soft reset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aSg5zR-6ZYXBuIVd@horms.kernel.org>
Date: Thu, 27 Nov 2025 11:45:17 +0000
From: Simon Horman <horms@...nel.org>
To: Sreedevi Joshi <sreedevi.joshi@...el.com>
Cc: intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	Aleksandr Loktionov <aleksandr.loktionov@...el.com>,
	Sridhar Samudrala <sridhar.samudrala@...el.com>,
	Emil Tantilov <emil.s.tantilov@...el.com>
Subject: Re: [PATCH iwl-net v2 3/3] idpf: Fix RSS LUT NULL ptr issue after
 soft reset

On Mon, Nov 24, 2025 at 12:47:50PM -0600, Sreedevi Joshi wrote:
> During soft reset, the RSS LUT is freed and not restored unless the
> interface is up. If an ethtool command that accesses the rss lut is
> attempted immediately after reset, it will result in NULL ptr
> dereference. Also, there is no need to reset the rss lut if the soft reset
> does not involve queue count change.
> 
> After soft reset, set the RSS LUT to default values based on the updated
> queue count only if the reset was a result of a queue count change and
> the LUT was not configured by the user. In all other cases, don't touch
> the LUT.
> 
> Steps to reproduce:
> 
> ** Bring the interface down (if up)
> ifconfig eth1 down
> 
> ** update the queue count (eg., 27->20)
> ethtool -L eth1 combined 20
> 
> ** display the RSS LUT
> ethtool -x eth1
> 
> [82375.558338] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [82375.558373] #PF: supervisor read access in kernel mode
> [82375.558391] #PF: error_code(0x0000) - not-present page
> [82375.558408] PGD 0 P4D 0
> [82375.558421] Oops: Oops: 0000 [#1] SMP NOPTI
> <snip>
> [82375.558516] RIP: 0010:idpf_get_rxfh+0x108/0x150 [idpf]
> [82375.558786] Call Trace:
> [82375.558793]  <TASK>
> [82375.558804]  rss_prepare.isra.0+0x187/0x2a0
> [82375.558827]  rss_prepare_data+0x3a/0x50
> [82375.558845]  ethnl_default_doit+0x13d/0x3e0
> [82375.558863]  genl_family_rcv_msg_doit+0x11f/0x180
> [82375.558886]  genl_rcv_msg+0x1ad/0x2b0
> [82375.558902]  ? __pfx_ethnl_default_doit+0x10/0x10
> [82375.558920]  ? __pfx_genl_rcv_msg+0x10/0x10
> [82375.558937]  netlink_rcv_skb+0x58/0x100
> [82375.558957]  genl_rcv+0x2c/0x50
> [82375.558971]  netlink_unicast+0x289/0x3e0
> [82375.558988]  netlink_sendmsg+0x215/0x440
> [82375.559005]  __sys_sendto+0x234/0x240
> [82375.559555]  __x64_sys_sendto+0x28/0x30
> [82375.560068]  x64_sys_call+0x1909/0x1da0
> [82375.560576]  do_syscall_64+0x7a/0xfa0
> [82375.561076]  ? clear_bhb_loop+0x60/0xb0
> [82375.561567]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> <snip>
> 
> Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks")
> Signed-off-by: Sreedevi Joshi <sreedevi.joshi@...el.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
> Reviewed-by: Sridhar Samudrala <sridhar.samudrala@...el.com>
> Reviewed-by: Emil Tantilov <emil.s.tantilov@...el.com>

Reviewed-by: Simon Horman <horms@...nel.org>