On 10/13/2026 5:12 AM, Tian Xun Ng wrote:
From: Tian Xun Ng <[email protected]>
mbx_task keeps handling mailbox events while idpf_deinit_task() releases
the vports: it requeues itself, or is queued from the mailbox interrupt,
until idpf_vc_core_deinit() cancels it once the vports are gone. A
VIRTCHNL2_EVENT_LINK_CHANGE event handled in that window looks its vport
up in adapter->vports[] without a lock, and idpf_vport_dealloc()
releases the netdev and frees the vport before it clears that slot, so
idpf_handle_event_link() can follow a NULL netdev pointer or use the
freed vport.
Make idpf_handle_event_link() return once IDPF_REMOVE_IN_PROG is set.
The previous patch waits for a running mbx_task after the bit is set and
before anything is released, so on remove a link event is either handled
before the vports are torn down or ignored. Shutdown has the same window
today; the last patch of this series sets the bit there as well. The
window also remains on a hard reset, which tears the vports down without
setting the bit; that path is not changed here.
Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Tian Xun Ng <[email protected]>
---
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
index d0db60647..2cfd216ae 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
@@ -40,6 +40,10 @@ static void idpf_handle_event_link(struct idpf_adapter
*adapter,
struct idpf_netdev_priv *np;
struct idpf_vport *vport;
+ /* The vports are released on remove and shutdown */
+ if (test_bit(IDPF_REMOVE_IN_PROG, adapter->flags))
+ return;
+
vport = idpf_vid_to_vport(adapter, le32_to_cpu(v2e->vport_id));
if (!vport) {
dev_err_ratelimited(&adapter->pdev->dev, "Failed to find vport_id %d
for link event\n",
Reviewed-by: Emil Tantilov <[email protected]>
