[v2] igb: Fix NULL pointer dereference in ethtool loopback test

[PATCH v2] igb: Fix NULL pointer dereference in ethtool loopback test

Posted by Tianyu Xu 1 month, 3 weeks ago

The igb driver currently causes a NULL pointer dereference when executing
the ethtool loopback test. This occurs because there is no associated
q_vector for the test ring when it is set up, as interrupts are typically
not added to the test rings.

Since commit 5ef44b3cb43b removed the napi_id assignment in
__xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it.
Therefore, simply use 0 as the last parameter.

Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Joe Damato <joe@dama.to>
Signed-off-by: Tianyu Xu <tianyxu@cisco.com>
---
Thanks to Aleksandr and Joe for your feedback. I have added the Fixes tag
and formatted the lines to 75 characters based on your comments.

 drivers/net/ethernet/intel/igb/igb_main.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a9a7a94ae..453deb6d1 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4453,8 +4453,7 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
 	if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
 		xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
 	res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,
-			       rx_ring->queue_index,
-			       rx_ring->q_vector->napi.napi_id);
+			       rx_ring->queue_index, 0);
 	if (res < 0) {
 		dev_err(dev, "Failed to register xdp_rxq index %u\n",
 			rx_ring->queue_index);
-- 
2.39.5 (Apple Git-154)

RE: [Intel-wired-lan] [PATCH v2] igb: Fix NULL pointer dereference in ethtool loopback test

Posted by Rinitha, SX 1 month ago

> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of Tianyu Xu
> Sent: 12 August 2025 18:41
> To: Nguyen, Anthony L <anthony.l.nguyen@intel.com>
> Cc: Kitszel, Przemyslaw <przemyslaw.kitszel@intel.com>; kuba@kernel.org; intel-wired-lan@lists.osuosl.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; Tianyu Xu <tianyxu@cisco.com>; Loktionov, Aleksandr <aleksandr.loktionov@intel.com>; Joe Damato <joe@dama.to>
> Subject: [Intel-wired-lan] [PATCH v2] igb: Fix NULL pointer dereference in ethtool loopback test
>
> The igb driver currently causes a NULL pointer dereference when executing the ethtool loopback test. This occurs because there is no associated q_vector for the test ring when it is set up, as interrupts are typically not added to the test rings.
>
> Since commit 5ef44b3cb43b removed the napi_id assignment in __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it.
> Therefore, simply use 0 as the last parameter.
>
> Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support")
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Joe Damato <joe@dama.to>
> Signed-off-by: Tianyu Xu <tianyxu@cisco.com>
> ---
> Thanks to Aleksandr and Joe for your feedback. I have added the Fixes tag and formatted the lines to 75 characters based on your comments.
>
> drivers/net/ethernet/intel/igb/igb_main.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>

Tested-by: Rinitha S <sx.rinitha@intel.com> (A Contingent worker at Intel)

Re: [Intel-wired-lan] [PATCH v2] igb: Fix NULL pointer dereference in ethtool loopback test

Posted by Paul Menzel 1 month, 3 weeks ago

Dear Tianyu,


Thank you for your patch.

Am 12.08.25 um 15:10 schrieb Tianyu Xu:
> The igb driver currently causes a NULL pointer dereference when executing
> the ethtool loopback test. This occurs because there is no associated

Where is this test located? Or, how do I run the test manually?

> q_vector for the test ring when it is set up, as interrupts are typically
> not added to the test rings.
> 
> Since commit 5ef44b3cb43b removed the napi_id assignment in
> __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it.
> Therefore, simply use 0 as the last parameter.
> 
> Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support")
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> Reviewed-by: Joe Damato <joe@dama.to>
> Signed-off-by: Tianyu Xu <tianyxu@cisco.com>
> ---
> Thanks to Aleksandr and Joe for your feedback. I have added the Fixes tag
> and formatted the lines to 75 characters based on your comments.
> 
>   drivers/net/ethernet/intel/igb/igb_main.c | 3 +--
>   1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
> index a9a7a94ae..453deb6d1 100644
> --- a/drivers/net/ethernet/intel/igb/igb_main.c
> +++ b/drivers/net/ethernet/intel/igb/igb_main.c
> @@ -4453,8 +4453,7 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
>   	if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
>   		xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
>   	res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,
> -			       rx_ring->queue_index,
> -			       rx_ring->q_vector->napi.napi_id);
> +			       rx_ring->queue_index, 0);
>   	if (res < 0) {
>   		dev_err(dev, "Failed to register xdp_rxq index %u\n",
>   			rx_ring->queue_index);

Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>


Kind regards,

Paul

Re: [Intel-wired-lan] [PATCH v2] igb: Fix NULL pointer dereference in ethtool loopback test

Posted by Tianyu Xu 1 month, 3 weeks ago

Hi Paul,
On my board with i210 NIC, "ethtool -t eth0" got the NULL pointer dereference.
After the fix, "ethtool -t eth0" works well.

Kind regards,
Tianyu.


Paul Menzel <pmenzel@molgen.mpg.de> 于2025年8月12日周二 22:00写道：
>
> Dear Tianyu,
>
>
> Thank you for your patch.
>
> Am 12.08.25 um 15:10 schrieb Tianyu Xu:
> > The igb driver currently causes a NULL pointer dereference when executing
> > the ethtool loopback test. This occurs because there is no associated
>
> Where is this test located? Or, how do I run the test manually?
>
> > q_vector for the test ring when it is set up, as interrupts are typically
> > not added to the test rings.
> >
> > Since commit 5ef44b3cb43b removed the napi_id assignment in
> > __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it.
> > Therefore, simply use 0 as the last parameter.
> >
> > Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support")
> > Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> > Reviewed-by: Joe Damato <joe@dama.to>
> > Signed-off-by: Tianyu Xu <tianyxu@cisco.com>
> > ---
> > Thanks to Aleksandr and Joe for your feedback. I have added the Fixes tag
> > and formatted the lines to 75 characters based on your comments.
> >
> >   drivers/net/ethernet/intel/igb/igb_main.c | 3 +--
> >   1 file changed, 1 insertion(+), 2 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
> > index a9a7a94ae..453deb6d1 100644
> > --- a/drivers/net/ethernet/intel/igb/igb_main.c
> > +++ b/drivers/net/ethernet/intel/igb/igb_main.c
> > @@ -4453,8 +4453,7 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
> >       if (xdp_rxq_info_is_reg(&rx_ring->xdp_rxq))
> >               xdp_rxq_info_unreg(&rx_ring->xdp_rxq);
> >       res = xdp_rxq_info_reg(&rx_ring->xdp_rxq, rx_ring->netdev,
> > -                            rx_ring->queue_index,
> > -                            rx_ring->q_vector->napi.napi_id);
> > +                            rx_ring->queue_index, 0);
> >       if (res < 0) {
> >               dev_err(dev, "Failed to register xdp_rxq index %u\n",
> >                       rx_ring->queue_index);
>
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
>
>
> Kind regards,
>
> Paul