Skip to contentSkip to conversation

bnxt_en: Fix NULL pointer dereference

PATCH Applied Kyle Meyer 3 participants 3 messages Jun 5 – Jun 10

Subsystems (3)
Networking Network drivers Broadcom bnxt_en 50 gigabit Ethernet driver
lore
Share & tools
lore

Kyle Meyer

author
#0 lore raw

PATCH 1/1 bnxt_en: Fix NULL pointer dereference

PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer.

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

Fixes e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
Cc [email protected]
Signed-off-by Kyle Meyer <[email protected]>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -1
index 008c34cff7b4..ec38a0a40875 100644
@@ -5748,7 +5748,7 @@ static void bnxt_disable_int_sync(struct bnxt *bp)
 {
 	int i;
 
-	if (!bp->irq_tbl)
+	if (!bp->irq_tbl || !bp->bnapi)
 		return;
 
 	atomic_inc(&bp->intr_sem);
Signature · 1 line
2.51.0
maintainer Reviewed-by on v1 1/1
#1 lore raw
Quoted 13 lines · Kyle Meyer

PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe error recovery on a closed NIC can dereference a NULL pointer.

Quoted 9 lines

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

Fixes e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
Cc [email protected]
Signed-off-by Kyle Meyer <[email protected]>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

LGTM. Thanks.

Reviewed-by Pavan Chebbi <[email protected]>
Quoted 16 lines
drivers/net/ethernet/broadcom/bnxt/bnxt.c +1 -2
index 008c34cff7b4..ec38a0a40875 100644
@@ -5748,7 +5748,7 @@ static void bnxt_disable_int_sync(struct bnxt *bp)
 {
        int i;
 
-       if (!bp->irq_tbl)
+       if (!bp->irq_tbl || !bp->bnapi)
                return;
 
        atomic_inc(&bp->intr_sem);
--

2.51.0

CI Applied
#2 lore raw
In reply to Kyle Meyer
This patch was applied to netdev/net.git (main) by Jakub Kicinski <[email protected]>:

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <[email protected]>:

Quoted 10 lines · On Fri, 5 Jun 2026 17:25:24 -0500 you wrote:

PCIe errors detected by a Root Port or Downstream Port cause error recovery services to run on all subordinate devices regardless of administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables and synchronizes IRQs via bnxt_disable_int_sync(), which calls bnxt_cp_num_to_irq_num() to map completion rings to IRQs using bp->bnapi.

[...]

Here is the summary with links:
- bnxt_en: Fix NULL pointer dereference

    https://git.kernel.org/netdev/net/c/d930276f2cdd

You are awesome, thank you!

Signature · 2 lines
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html