RE: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory leak in interrupt request

[Salin, Samuel]

> -----Original Message-----
> From: Loktionov, Aleksandr <aleksandr.loktionov@xxxxxxxxx>
> Sent: Tuesday, September 8, 2026 6:15 AM
> To: Zhang Yunfei <zhangyunfei1@xxxxxxxxxx>; Nguyen, Anthony L
> <anthony.l.nguyen@xxxxxxxxx>
> Cc: Kitszel, Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; intel-wired-
> lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx;
> stable@xxxxxxxxxxxxxxx
> Subject: RE: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory
> leak in interrupt request
> 
> 
> 
> > -----Original Message-----
> > From: Zhang Yunfei <zhangyunfei1@xxxxxxxxxx>
> > Sent: Friday, September 4, 2026 11:18 AM
> > To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>
> > Cc: Kitszel, Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; intel-wired-
> > lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-
> > kernel@xxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx
> > Subject: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory
> > leak in interrupt request
> >
> > The kasprintf() call in idpf_vport_intr_req_irq() can return NULL on
> > memory pressure, but the result is passed directly to request_irq()
> > without a NULL check. The IRQ core then stores this pointer as
> > action->name and dereferences it later from /proc/interrupts and
> > procfs, leading to a NULL pointer dereference.
> >
> > Add a NULL check after kasprintf() and bail out with -ENOMEM.
> >
> > Additionally, when request_irq() fails, request_threaded_irq() frees
> > the irqaction itself without taking ownership of the name string, so
> > the caller-allocated name is leaked. Free it on the error path only.
> > On the success path the name is owned by the irq action and released
> > later via kfree(free_irq(...)) in the cleanup loop, so it must not be
> > freed here.
> >
> > Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport")
> > Cc: stable@xxxxxxxxxxxxxxx # 6.7
> > Signed-off-by: Zhang Yunfei <zhangyunfei1@xxxxxxxxxx>
> > ---
> >  drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > index 24b91be25676..86dedf5c1c09 100644
> > --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
> > @@ -4063,12 +4063,17 @@ static int idpf_vport_intr_req_irq(struct
> > idpf_vport *vport,
> >
> >  		name = kasprintf(GFP_KERNEL, "%s-%s-%s-%d", drv_name,
> if_name,
> >  				 vec_name, vector);
> > +		if (!name) {
> > +			err = -ENOMEM;
> > +			goto free_q_irqs;
> > +		}
> >
> >  		err = request_irq(irq_num, idpf_vport_intr_clean_queues, 0,
> >  				  name, q_vector);
> >  		if (err) {
> >  			netdev_err(vport->netdev,
> >  				   "Request_irq failed, error: %d\n", err);
> > +			kfree(name);
> >  			goto free_q_irqs;
> >  		}
> >
> > --
> > 2.25.1
> 
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>

Tested-by: Samuel Salin <Samuel.salin@xxxxxxxxx>