]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
idpf: nullify pointers after they are freed
authorLi Li <boolli@google.com>
Fri, 23 Jan 2026 06:58:06 +0000 (06:58 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 2 Apr 2026 11:09:54 +0000 (13:09 +0200)
commit bc3b31977314433e4685ae92853d1b6e91ad7bc2 upstream.

rss_data->rss_key needs to be nullified after it is freed.
Checks like "if (!rss_data->rss_key)" in the code could fail
if it is not nullified.

Tested: built and booted the kernel.

Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool operations")
Signed-off-by: Li Li <boolli@google.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Samuel Salin <Samuel.salin@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/intel/idpf/idpf_lib.c

index 02915646b8e68fc799415e44c270ac674f071852..4973135c346a2dbdc5949489de650f5c47c043f0 100644 (file)
@@ -1230,6 +1230,7 @@ static struct idpf_vport *idpf_vport_alloc(struct idpf_adapter *adapter,
 
 free_rss_key:
        kfree(rss_data->rss_key);
+       rss_data->rss_key = NULL;
 free_vector_idxs:
        kfree(vport->q_vector_idxs);
 free_vport: