netdev - Re: [PATCH v1 iwl-next] ice: fix NULL pointer dereference when changing RX queue length

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bcefc3ee-4704-483a-8271-01677e47eb8b@intel.com>
Date: Mon, 2 Feb 2026 16:31:39 -0800
From: Jacob Keller <jacob.e.keller@...el.com>
To: Kohei Enju <kohei@...uk.jp>, <intel-wired-lan@...ts.osuosl.org>,
	<netdev@...r.kernel.org>
CC: Tony Nguyen <anthony.l.nguyen@...el.com>, Przemek Kitszel
	<przemyslaw.kitszel@...el.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Jakub
 Kicinski" <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Aleksandr
 Loktionov" <aleksandr.loktionov@...el.com>, Alexander Lobakin
	<aleksander.lobakin@...el.com>, <kohei.enju@...il.com>
Subject: Re: [PATCH v1 iwl-next] ice: fix NULL pointer dereference when
 changing RX queue length



On 2/2/2026 8:17 AM, Kohei Enju wrote:
> When changing RX queue length via 'ethtool -G $DEV rx $NUM', a WARNING
> indicates the driver missed unregistering xdp_rxq_info [1], and then
> NULL pointer dereference panics the kernel. [2]
> 
> The following sequence in ice_set_ringparam() triggers this bug.
> 1. Allocate new rx_rings
> 2. rx_rings[i] = *vsi->rx_rings[i];
> 3. ice_down() unregisters vsi->rx_rings[i]->xdp_rxq
> 4. ice_up() registers rx_ring[i]->xdp_rxq
>     a. __xdp_rxq_info_reg() sees the copied state REG_STATE_REGISTERED
>        and calls xdp_rxq_info_unreg() to fix it [1]
>     b. xdp_unreg_mem_model() looks up the stale mem.id in rhashtable,
>        which was already removed in step 3, causing NULL dereference [2]
> 
> The root cause is that struct copying includes xdp_rxq_info which
> contains registration state that should not be duplicated.
> 
> Fix by clearing xdp_rxq_info after copying the ring so it starts with
> REG_STATE_NEW instead of the stale REG_STATE_REGISTERED.
> 
> [1]
>   Missing unregister, handled but fix driver
>   WARNING: net/core/xdp.c:182 at __xdp_rxq_info_reg+0x89/0x150, CPU#4: ethtool/1105
>   [...]
>   RIP: 0010:__xdp_rxq_info_reg+0x89/0x150
>   [...]
>   Call Trace:
>    <TASK>
>    ice_queue_mem_alloc+0x159/0x240
>    ice_vsi_cfg_rxq+0xc3/0x160
>    ice_vsi_cfg_rxqs+0x4f/0x70
>    ice_up+0xd/0x20
>    ice_set_ringparam+0x34f/0x4e0
> 
> [2]
>   BUG: kernel NULL pointer dereference, address: 0000000000000008
>   [...]
>   RIP: 0010:xdp_unreg_mem_model+0x113/0x340
>   [...]
>   Call Trace:
>    <TASK>
>    __xdp_rxq_info_reg+0xfd/0x150
>    ice_queue_mem_alloc+0x159/0x240
>    ice_vsi_cfg_rxq+0xc3/0x160
>    ice_vsi_cfg_rxqs+0x4f/0x70
>    ice_up+0xd/0x20
>    ice_set_ringparam+0x34f/0x4e0
> 
> Fixes: 111a8e2be488 ("ice: implement Rx queue management ops")
> Signed-off-by: Kohei Enju <kohei@...uk.jp>
> ---
> I see the Fixes: commit exists in only tnguy/next-queue.git, so I'm
> sending this patch to iwl-next, not iwl-net.
> 
> Also IIUC dev-queue in tnguy/next-queue.git is rebased continuously, so
> the commit hash will be stale soon, and I don't know how to handle this.
> 

Yea. Including the full subject line should be sufficient for Tony to 
find this.

> I'd appreciate it if iwl-folks know the way to handle it. Thanks!

Ideally we can squash this in with the implementation patches and 
include your Co-developed-by and Signed-off-by tags if you would agree 
to that?