]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bnxt_en: Fix NULL pointer dereference
authorKyle Meyer <kyle.meyer@hpe.com>
Fri, 5 Jun 2026 22:25:24 +0000 (17:25 -0500)
committerJakub Kicinski <kuba@kernel.org>
Wed, 10 Jun 2026 00:52:46 +0000 (17:52 -0700)
commitd930276f2cddd0b7294cac7a8fe7b877f6d9e08d
tree85fd60da08cdd488a2863a90dc68603f0436cf36
parenta5f8a90ac9f77c678a9781c0a464b635e0d63e49
bnxt_en: Fix NULL pointer dereference

PCIe errors detected by a Root Port or Downstream Port cause error
recovery services to run on all subordinate devices regardless of
administrative state.

The .error_detected() callback, bnxt_io_error_detected(), disables
and synchronizes IRQs via bnxt_disable_int_sync(), which calls
bnxt_cp_num_to_irq_num() to map completion rings to IRQs using
bp->bnapi.

Since bp->bnapi is allocated on NIC open and freed on NIC close, PCIe
error recovery on a closed NIC can dereference a NULL pointer.

Check if bp->bnapi is NULL before disabling and synchronizing IRQs.

Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
Cc: stable@vger.kernel.org
Signed-off-by: Kyle Meyer <kyle.meyer@hpe.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/aiNM1CY2-StPilxW@hpe.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/ethernet/broadcom/bnxt/bnxt.c