> -----Original Message----- > From: Loktionov, Aleksandr <[email protected]> > Sent: Tuesday, September 8, 2026 6:15 AM > To: Zhang Yunfei <[email protected]>; Nguyen, Anthony L > <[email protected]> > Cc: Kitszel, Przemyslaw <[email protected]>; intel-wired- > [email protected]; [email protected]; [email protected]; > [email protected] > Subject: RE: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory > leak in interrupt request > > > > > -----Original Message----- > > From: Zhang Yunfei <[email protected]> > > Sent: Friday, September 4, 2026 11:18 AM > > To: Nguyen, Anthony L <[email protected]> > > Cc: Kitszel, Przemyslaw <[email protected]>; intel-wired- > > [email protected]; [email protected]; linux- > > [email protected]; [email protected] > > Subject: [PATCH iwl-net] idpf: fix NULL pointer dereference and memory > > leak in interrupt request > > > > The kasprintf() call in idpf_vport_intr_req_irq() can return NULL on > > memory pressure, but the result is passed directly to request_irq() > > without a NULL check. The IRQ core then stores this pointer as > > action->name and dereferences it later from /proc/interrupts and > > procfs, leading to a NULL pointer dereference. > > > > Add a NULL check after kasprintf() and bail out with -ENOMEM. > > > > Additionally, when request_irq() fails, request_threaded_irq() frees > > the irqaction itself without taking ownership of the name string, so > > the caller-allocated name is leaked. Free it on the error path only. > > On the success path the name is owned by the irq action and released > > later via kfree(free_irq(...)) in the cleanup loop, so it must not be > > freed here. > > > > Fixes: d4d558718266 ("idpf: initialize interrupts and enable vport") > > Cc: [email protected] # 6.7 > > Signed-off-by: Zhang Yunfei <[email protected]> > > --- > > drivers/net/ethernet/intel/idpf/idpf_txrx.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c > > b/drivers/net/ethernet/intel/idpf/idpf_txrx.c > > index 24b91be25676..86dedf5c1c09 100644 > > --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c > > +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c > > @@ -4063,12 +4063,17 @@ static int idpf_vport_intr_req_irq(struct > > idpf_vport *vport, > > > > name = kasprintf(GFP_KERNEL, "%s-%s-%s-%d", drv_name, > if_name, > > vec_name, vector); > > + if (!name) { > > + err = -ENOMEM; > > + goto free_q_irqs; > > + } > > > > err = request_irq(irq_num, idpf_vport_intr_clean_queues, 0, > > name, q_vector); > > if (err) { > > netdev_err(vport->netdev, > > "Request_irq failed, error: %d\n", err); > > + kfree(name); > > goto free_q_irqs; > > } > > > > -- > > 2.25.1 > > Reviewed-by: Aleksandr Loktionov <[email protected]>
Tested-by: Samuel Salin <[email protected]>
