On Fri, Jan 23, 2026 at 6:27 AM Li Li <[email protected]> wrote: > > rss_data->rss_key and vport->q_vector_idxs need to be nullified after > they are freed. Checks like "if (!rss_data->rss_key)" and > "if (!vport->q_vector_idxs)" in the code could fail if they are not > nullified. > > Tested: built and booted the kernel. > > Fixes: 83f38f210b85 ("idpf: Fix RSS LUT NULL pointer crash on early ethtool > operations") > Fixes: 8a558cbda51b ("idpf: fix potential memory leak on kcalloc() failure") > Signed-off-by: Li Li <[email protected]> > --- > drivers/net/ethernet/intel/idpf/idpf_lib.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c > b/drivers/net/ethernet/intel/idpf/idpf_lib.c > index 131a8121839bd..7af4214ec44de 100644 > --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c > +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c > @@ -1308,8 +1308,10 @@ static struct idpf_vport *idpf_vport_alloc(struct > idpf_adapter *adapter, > > free_rss_key: > kfree(rss_data->rss_key); > + rss_data->rss_key = NULL; > free_vector_idxs: > kfree(vport->q_vector_idxs); > + vport->q_vector_idxs = NULL;
vport is freed right after this line. vport->q_vector_idxs content is not relevant. If anything tries to deref vport->any_field ater at this point, there is another bug. KASAN might help. > free_vport: > kfree(vport); > > -- > 2.52.0.457.g6b5491de43-goog >
