Re: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory leak in interrupt request

[Simon Horman]

On Fri, Sep 04, 2026 at 05:18:27PM +0800, Zhang Yunfei wrote:
> The kasprintf() call in idpf_vport_intr_req_irq() can return NULL on
> memory pressure, but the result is passed directly to request_irq()
> without a NULL check. The IRQ core then stores this pointer as
> action->name and dereferences it later from /proc/interrupts and
> procfs, leading to a NULL pointer dereference.
> 
> Add a NULL check after kasprintf() and bail out with -ENOMEM.
> 
> Additionally, when request_irq() fails, request_threaded_irq() frees
> the irqaction itself without taking ownership of the name string, so
> the caller-allocated name is leaked. Free it on the error path only.
> On the success path the name is owned by the irq action and released
> later via kfree(free_irq(...)) in the cleanup loop, so it must not be
> freed here.
> 
> Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport")
> Cc: stable@xxxxxxxxxxxxxxx # 6.7
> Signed-off-by: Zhang Yunfei <zhangyunfei1@xxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>