]> git.ipfire.org Git - thirdparty/linux.git/commit
idpf: only assign num refillqs if allocation was successful
authorJoshua Hay <joshua.a.hay@intel.com>
Sat, 7 Mar 2026 02:12:47 +0000 (18:12 -0800)
committerTony Nguyen <anthony.l.nguyen@intel.com>
Mon, 23 Mar 2026 20:29:51 +0000 (13:29 -0700)
commitb5e5797e3cd1fd1561b212b2b94f8865d07f2890
tree52ba7fedf576682106cdc62281e7964acf8191bf
parent1eb0db7e39da3d20ff6dfb8d359655329ea6f839
idpf: only assign num refillqs if allocation was successful

As reported by AI review [1], if the refillqs allocation fails, refillqs
will be NULL but num_refillqs will be non-zero. The release function
will then dereference refillqs since it thinks the refillqs are present,
resulting in a NULL ptr dereference.

Only assign the num refillqs if the allocation was successful. This will
prevent the release function from entering the loop and accessing
refillqs.

[1] https://lore.kernel.org/netdev/20260227035625.2632753-1-kuba@kernel.org/

Fixes: 95af467d9a4e3 ("idpf: configure resources for RX queues")
Signed-off-by: Joshua Hay <joshua.a.hay@intel.com>
Reviewed-by: Madhu Chittim <madhu.chittim@intel.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Tested-by: Samuel Salin <Samuel.salin@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
drivers/net/ethernet/intel/idpf/idpf_txrx.c