RE: [PATCH iwl-net] ice: fix NULL dereference after disabling RDMA

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Vincent Choiniere via B4 Relay
> <devnull+choiniere.vincent.hydroquebec.com@xxxxxxxxxx>
> Sent: Monday, October 26, 2026 2:30 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@xxxxxxxxx>; Andrew Lunn <andrew+netdev@xxxxxxx>;
> David S. Miller <davem@xxxxxxxxxxxxx>; Eric Dumazet
> <edumazet@xxxxxxxxxx>; Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni
> <pabeni@xxxxxxxxxx>
> Cc: Michal Swiatkowski <michal.swiatkowski@xxxxxxxxxxxxxxx>; intel-
> wired-lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; stable@xxxxxxxxxxxxxxx; Vincent Choiniere
> <choiniere.vincent@xxxxxxxxxxxxxxx>
> Subject: [PATCH iwl-net] ice: fix NULL dereference after disabling RDMA
> 
> From: Vincent Choiniere <choiniere.vincent@xxxxxxxxxxxxxxx>
> 
> ice_deinit_rdma() checks ice_is_rdma_ena() before dereferencing
> pf->cdev_info. While the enable_rdma devlink driverinit parameter is
> registered, that helper returns the parameter value. Once the parameter
> is unregistered, it falls back to ICE_FLAG_RDMA_ENA.
> 
> When enable_rdma is set to false and applied by a devlink reload,
> ice_init_rdma() returns early, leaving pf->cdev_info NULL. During driver
> removal, ice_remove() calls ice_deinit_devlink() before ice_unload().
> The parameters are therefore unregistered before ice_deinit_rdma() runs.
> On an RDMA-capable device, ice_is_rdma_ena() then returns true, allowing
> ice_deinit_rdma() to dereference the NULL pointer.
> 
> This can cause a panic during reboot, module removal or PCI unbind.
> Reproduced on an E810 PF with Ubuntu kernel 7.0.0-14 (PREEMPT_RT):
> 
>  devlink dev param set pci/0000:02:00.0 name enable_rdma value false \
>          cmode driverinit
>  devlink dev reload pci/0000:02:00.0 action driver_reinit  systemctl
> reboot
> 
>  BUG: kernel NULL pointer dereference, address: 0000000000000018
>  RIP: 0010:ice_deinit_rdma+0x30/0x60 [ice]
>   ice_unload+0x3f/0x150 [ice]
>   ice_remove+0xb5/0x1d0 [ice]
>   ice_shutdown+0x1b/0x60 [ice]
>   pci_device_shutdown
>   device_shutdown
>   kernel_restart
>  Kernel panic - not syncing: Attempted to kill init!
> 
> Check pf->cdev_info before dereferencing it, as
> ice_rdma_update_vsi_filter() already does. This preserves the existing
> enable_rdma semantics without changing other ice_is_rdma_ena() callers.
> 
> Fixes: 87181cd6985f ("ice: enable_rdma devlink param")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Vincent Choiniere <choiniere.vincent@xxxxxxxxxxxxxxx>
> ---
> Testing was performed on an E810 PF passed through to a KVM guest, using
> Ubuntu kernel 7.0.0-38 (PREEMPT_RT). Two kernels differing only by this
> patch were compared. Each test set enable_rdma=false and applied it with
> devlink reload driver_reinit before the removal step.
> 
>   Removal path      Without patch           With patch
>   reboot (x3)       NULL deref, panic (3/3) clean (3/3)
>   rmmod ice         NULL deref              clean
>   PCI unbind        NULL deref              clean
> 
> Additional checks on the patched kernel:
>   - Reboot without a preceding devlink reload completed cleanly.
>   - irdma devices returned after PCI unbind/bind.
>   - irdma devices returned after an enable_rdma false -> true reload
>     cycle.
> 
> No KASAN or kmemleak testing was performed.
> 
> The exact target tree (net, 7076f684d5132e6a) was not built or tested.
> ice_deinit_rdma() and ice_is_rdma_ena() are unchanged there compared
> with the tested code.
> ---
>  drivers/net/ethernet/intel/ice/ice_idc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c
> b/drivers/net/ethernet/intel/ice/ice_idc.c
> index 102d63c30..09dfcffeb 100644
> --- a/drivers/net/ethernet/intel/ice/ice_idc.c
> +++ b/drivers/net/ethernet/intel/ice/ice_idc.c
> @@ -454,7 +454,7 @@ int ice_init_rdma(struct ice_pf *pf)
>   */
>  void ice_deinit_rdma(struct ice_pf *pf)  {
> -	if (!ice_is_rdma_ena(pf))
> +	if (!ice_is_rdma_ena(pf) || !pf->cdev_info)
>  		return;
> 
>  	xa_erase(&ice_aux_id, pf->aux_idx);
> 
> ---
> base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
> change-id: 20261025-ice-deinit-rdma-null-613f1be33f72
> 

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>