From nobody Sun Feb 8 10:32:55 2026 Received: from mail-ot1-f45.google.com (mail-ot1-f45.google.com [209.85.210.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E470521C9E5 for ; Wed, 31 Dec 2025 13:05:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.45 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767186362; cv=none; b=T8G4T9GZS0/vJRGdM/X3Roab8doNzKxa03zLAxO+Ao/h3bj3gl2ltzVEYbu/164nCYWpQU0pFJ2J8TaaKOUgC86m9x+nGQOR6C68Sl6GOloL6AlMyGD4GK0XKT8hlWiB7wwqviVm6qNosGRlgwXnlD+TTlbEM/eth07QBHawnk0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1767186362; c=relaxed/simple; bh=MDcd1bGhccG6X9ai4kuqFpZk9zpxTDM/8y4BfsTO1bE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=hRlJpEkLdzPVVUc2Y/thKne+zfzZB/RYUltZaPQmn1QIgJGhlnvh9/e4gd6zCLgyUfp/BLbnkpQdjHcbCb/9Pu2nUCx/SI6sGmRE6oQ08+XWGW3DxBUbB+5Dmh2mPCt7SrzTtMsFhq2diivSLrvJLu1I6LIAvVPvlpa7ZF8klnU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org; spf=pass smtp.mailfrom=gmail.com; arc=none smtp.client-ip=209.85.210.45 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=debian.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Received: by mail-ot1-f45.google.com with SMTP id 46e09a7af769-7cae2330765so7477077a34.0 for ; Wed, 31 Dec 2025 05:05:59 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1767186359; x=1767791159; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pbnElRqbRnD4WG3UkShPsEoYZpnGixbcSQcdBWQX0Ew=; b=RcuCXpFT4CF3skdOJPpv1ULTOxQmAU9bYCzuWDfBCPuW2sIJE/uVBoXjyrYQ4vdTsC Qfh5+Q5LhbXVoQT5vjFBXPr1W009iJd+s+A/LhzxaKfirYZnMUnM97s3vM8O1sCa1KcH vwoYkpcODZVJWLCSWlFfokpOVT0q0H1dsy455dLyDZj0hauAf6bSoaBgTPJVYNJ7njAb Zj2UkRkTsdlUKfH/OboNJPiQ4cRDxdnDXlfR1gp9lDFbYIBiVO3JkVd/dR8zgwbsFbC/ h8BblFXaMHkKDZnkg/pwAWgQjul0iS9BRcsD8y88EAzWrCcqsdkRAijWNvjtp72uiNO+ l20w== X-Forwarded-Encrypted: i=1; AJvYcCXtR4XaXV2uLO3VulaZLU0hlhg6uh46ivpFoEdhQkagEcoqhgaHi5IQJnlrOJ/VMwZDX09s4SLlAlxbZyM=@vger.kernel.org X-Gm-Message-State: AOJu0YyXbvdGUv2ma51SVdSk5HAa/t2rk0ConFQ6kmSHdzm5RhAYWEGh eF82bayAd/ysKwE+i4b/pBlY1FgyxCJJestBW7Nsr8lmLenSb8+TbwB/ X-Gm-Gg: AY/fxX6KVVonXrbY0m/n7PkbtmWZA0HpJLvIDAl4JNYfP+5ZJ0S+WnXN2RUEW4Zxbua Lgd07YyzqVZf9JD0I/6SY+oDYX3C2JH6EVIM2r1qkS6igrByi1jS5Bs09ASjKDILzWoZw53W3Aq NpLWJ2+3Ao7CMKjsCQygUgiQjKNOIMnJGrvKy9+u6L4llBKlgRX3hk9RM38hPHsuEGZbtp+BTOB /mWAXxbu8gYd3DN7qIIgJJ2tdF1szO/v1K2cC83W+W+zyozMY4HEbPvTWrkkIwEA7e8RQJhdstW I+bmBavpJhZOMbKnRt3G+ZhJdkkXsRGf/HqNHjfucmoITphLJwLqlprllYaAkO5NNv+oMEhPEQk TPwaV1YrYJwBYPPKFZT2ezgf83u2NxtQQJpcPUsZQjaRM/miHoX3AOcfAsTSJwOBiKy6kF+o94c mMl7JrlhqPHjadrQ== X-Google-Smtp-Source: AGHT+IEYrzaVvZv/bIMY6srXwLcMFuv6qqbv2T7g2ZyO0CjurEzavAPpm4aq7O+Bni2FRGchzZfHgA== X-Received: by 2002:a05:6830:11c2:b0:785:6792:4b3 with SMTP id 46e09a7af769-7cc5926f15dmr16552158a34.10.1767186358781; Wed, 31 Dec 2025 05:05:58 -0800 (PST) Received: from localhost ([2a03:2880:10ff:48::]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7cc667281fesm24446233a34.6.2025.12.31.05.05.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 Dec 2025 05:05:58 -0800 (PST) From: Breno Leitao Date: Wed, 31 Dec 2025 05:05:34 -0800 Subject: [PATCH net] bnxt_en: Fix NULL pointer crash in bnxt_ptp_enable during error cleanup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20251231-bnxt-v1-1-8f9cde6698b4@debian.org> X-B4-Tracking: v=1; b=H4sIAJ4fVWkC/yXMQQqDMBAF0KsMf22giUpLriIuTDLqdBElSYsg3 l3U7Vu8HZmTcIalHYn/kmWJsKQrgp+HOLGSAEswL9NqU2vl4laUb5tQ63f4uJFREdbEo2x30yF yQf9g/rkv+3IFOI4T3nSalG0AAAA= X-Change-ID: 20251231-bnxt-c54d317d8bfe To: Michael Chan , Pavan Chebbi , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Richard Cochran , "Russell King (Oracle)" , Vadim Fedorenko , Vladimir Oltean Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com, Breno Leitao , stable@vger.kernel.org X-Mailer: b4 0.15-dev-47773 X-Developer-Signature: v=1; a=openpgp-sha256; l=2910; i=leitao@debian.org; h=from:subject:message-id; bh=MDcd1bGhccG6X9ai4kuqFpZk9zpxTDM/8y4BfsTO1bE=; b=owEBbQKS/ZANAwAIATWjk5/8eHdtAcsmYgBpVR+1FiLsstnJScE9knBwtFyXA31Y5m9+ra75Y GxF3pU4EnGJAjMEAAEIAB0WIQSshTmm6PRnAspKQ5s1o5Of/Hh3bQUCaVUftQAKCRA1o5Of/Hh3 bfaJD/sGSpBK+ivtrCA5bmOPt6CGYezAsTYL2EcFDmCkdYSp2NUHIj0RjAiRmCHC/YEONVg5xWJ KUGiQ0kfwVmtB8IpXO7iBxKtvM1JLBscyF88FzpqWhf5xqL2xBgTKgQXMdtXuysYDY4/EiEyAp0 M1i5v0IKphUqV9O19F01GkikQuYLO/J6F9a9rjRaQBh6SDm+WKP3eVqGuP3Pb64zWRTqSwmFQrU svD+BFYUjaetg9RHd7yrPih1lX29NejtU33VEGdodZS4zwBr+vIMkY8CE4sAdahzyLb6PRbwQLB ZdmRWNkjfsqi3qpu9G9N9Di4KspHFeWPepVXtI0j7hjbFBERJNHWkPXQKBKyHDI0VAVAA8eVTW6 T+AL9arnKOEh0EKK/qhI76SgIQWSGVTSar0XP7E6y9nFgdihoBQ1YvYTKdn7beRBZqcyHI676iN w7zJaUPhDpoSMpnstQ1Ol2skw1P2w+54CNfKY4DZTvjrZ4x/F+KLXQdWmn+U6YbJK5s9mhMC78k blVyeWf+5SDHCU7KG1P/RHA2LBKyPBuSC7O3aUniARJnNqC3cDKwGcAzHmu4vgluHgBCTAN+9I5 1SYLzAzKlbikZmbTtbnHNzt1P/+J9IvAwpKcjEZ1HCnva3EoV7jngH4ojExALGfhRqsiG44bMvJ Gx3RixyKlyf/dTg== X-Developer-Key: i=leitao@debian.org; a=openpgp; fpr=AC8539A6E8F46702CA4A439B35A3939FFC78776D When bnxt_init_one() fails during initialization (e.g., bnxt_init_int_mode returns -ENODEV), the error path calls bnxt_free_hwrm_resources() which destroys the DMA pool and sets bp->hwrm_dma_pool to NULL. Subsequently, bnxt_ptp_clear() is called, which invokes ptp_clock_unregister(). Since commit a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events"), ptp_clock_unregister() now calls ptp_disable_all_events(), which in turn invokes the driver's .enable() callback (bnxt_ptp_enable()) to disable PTP events before completing the unregistration. bnxt_ptp_enable() attempts to send HWRM commands via bnxt_ptp_cfg_pin() and bnxt_ptp_cfg_event(), both of which call hwrm_req_init(). This function tries to allocate from bp->hwrm_dma_pool, causing a NULL pointer dereference: bnxt_en 0000:01:00.0 (unnamed net_device) (uninitialized): bnxt_init_int_= mode err: ffffffed KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] Call Trace: __hwrm_req_init (drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c:72) bnxt_ptp_enable (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:323 drive= rs/net/ethernet/broadcom/bnxt/bnxt_ptp.c:517) ptp_disable_all_events (drivers/ptp/ptp_chardev.c:66) ptp_clock_unregister (drivers/ptp/ptp_clock.c:518) bnxt_ptp_clear (drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c:1134) bnxt_init_one (drivers/net/ethernet/broadcom/bnxt/bnxt.c:16889) Lines are against commit f8f9c1f4d0c7 ("Linux 6.19-rc3") Fix this by checking if bp->hwrm_dma_pool is NULL at the start of bnxt_ptp_enable(). During error/cleanup paths when HWRM resources have been freed, return success without attempting to send commands since the hardware is being torn down anyway. During normal operation, the DMA pool is always valid so PTP functionality is unaffected. Signed-off-by: Breno Leitao Fixes: a60fc3294a37 ("ptp: rework ptp_clock_unregister() to disable events") Cc: stable@vger.kernel.org --- drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/et= hernet/broadcom/bnxt/bnxt_ptp.c index a8a74f07bb54..a749bbfa398e 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c @@ -482,6 +482,13 @@ static int bnxt_ptp_enable(struct ptp_clock_info *ptp_= info, int pin_id; int rc; =20 + /* Return success if HWRM resources are not available. + * This can happen during error/cleanup paths when DMA pool has been + * freed. + */ + if (!bp->hwrm_dma_pool) + return 0; + switch (rq->type) { case PTP_CLK_REQ_EXTTS: /* Configure an External PPS IN */ --- base-commit: 80380f6ce46f38a0d1200caade2f03de4b6c1d27 change-id: 20251231-bnxt-c54d317d8bfe Best regards, -- =20 Breno Leitao