netdev - Re: [Intel-wired-lan] [PATCH v2] idpf: nullify pointers after they are freed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAODvEq7yoXMvhkZhzcF4rgaceCnxCfzgKbSa5+SMVMO1X+XgdQ@mail.gmail.com>
Date: Fri, 23 Jan 2026 00:01:28 -0800
From: Li Li <boolli@...gle.com>
To: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
Cc: "Nguyen, Anthony L" <anthony.l.nguyen@...el.com>, 
	"Kitszel, Przemyslaw" <przemyslaw.kitszel@...el.com>, "David S. Miller" <davem@...emloft.net>, 
	Jakub Kicinski <kuba@...nel.org>, Eric Dumazet <edumazet@...gle.com>, 
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>, 
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>, 
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, David Decotigny <decot@...gle.com>, 
	"Singhai, Anjali" <anjali.singhai@...el.com>, 
	"Samudrala, Sridhar" <sridhar.samudrala@...el.com>, Brian Vazquez <brianvv@...gle.com>, 
	"Tantilov, Emil S" <emil.s.tantilov@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH v2] idpf: nullify pointers after they
 are freed

On Thu, Jan 22, 2026 at 11:15 PM Loktionov, Aleksandr
<aleksandr.loktionov@...el.com> wrote:
>
>
>
> > -----Original Message-----
> > From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
> > Of Li Li via Intel-wired-lan
> > Sent: Friday, January 23, 2026 7:58 AM
> > To: Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel,
> > Przemyslaw <przemyslaw.kitszel@...el.com>; David S. Miller
> > <davem@...emloft.net>; Jakub Kicinski <kuba@...nel.org>; Eric Dumazet
> > <edumazet@...gle.com>; intel-wired-lan@...ts.osuosl.org
> > Cc: netdev@...r.kernel.org; linux-kernel@...r.kernel.org; David
> > Decotigny <decot@...gle.com>; Singhai, Anjali
> > <anjali.singhai@...el.com>; Samudrala, Sridhar
> > <sridhar.samudrala@...el.com>; Brian Vazquez <brianvv@...gle.com>; Li
> > Li <boolli@...gle.com>; Tantilov, Emil S <emil.s.tantilov@...el.com>
> > Subject: [Intel-wired-lan] [PATCH v2] idpf: nullify pointers after
> > they are freed
> >
> > rss_data->rss_key needs to be nullified after it is freed.
> > Checks like "if (!rss_data->rss_key)" in the code could fail if it is
> > not nullified.
> >
> > Tested: built and booted the kernel.
> >
> Good day ,Li Li
>
> Can you re-spin v3 and mention the reproduction steps (exact bash commands)?
> The CALL trace from dmesg also is needed for users/admins to find the fix.

Thank you for the review. This patch isn't to fix any kernel panics we
encountered. It is
just to address a discrepancy I observed between the Google idpf and
the upstream idpf
as I was preparing for another patch about to be sent out. So far we
haven't seen this
particular dangling pointer cause any issues yet, but it's still a
good practice to set it to
NULL because there are other places guarded by this pointer being
NULL, and it'd be
great to avoid any race conditions.

>
> Otherwise, fine
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
>
> > Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early
> > ethtool operations")
> > Signed-off-by: Li Li <boolli@...gle.com>
> > ---
> > Changes in v2:
> >  - Remove the line to nullify vport->q_vector_idxs as it is not
> >    necessary.
> >
> >  drivers/net/ethernet/intel/idpf/idpf_lib.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> > b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> > index 131a8121839bd..f63ab58428d2e 100644
> > --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> > +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> > @@ -1308,6 +1308,7 @@ static struct idpf_vport
> > *idpf_vport_alloc(struct idpf_adapter *adapter,
> >
> >  free_rss_key:
> >       kfree(rss_data->rss_key);
> > +     rss_data->rss_key = NULL;
> >  free_vector_idxs:
> >       kfree(vport->q_vector_idxs);
> >  free_vport:
> > --
> > 2.52.0.457.g6b5491de43-goog
>