From nobody Sun Feb 8 02:26:09 2026 Received: from smtp-relay-internal-1.canonical.com (smtp-relay-internal-1.canonical.com [185.125.188.123]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E433830C61D for ; Wed, 21 Jan 2026 07:51:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.123 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768981907; cv=none; b=a+YAoDOepCUmM3sr2pMNRyR0Mn0T9rmScdE+f9xBflo9Wy/2AGKon7uFeU0FqcAcxJiAFFpdYwLjP2EnfR8zDVwc9oTUUgH+S+sA2iOqhesm/G3p4tHrvuQtCpe0VbPRHaj+Pdutn+izQanq3fu4LmqnrGZ3n2O0GRxWRBiwAfE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1768981907; c=relaxed/simple; bh=3Wvto2L/i7ELb+RtswT4bkc5TiCycoPC0QPWQTZpVJw=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=HAJIqq/6eo9VsWec9G2BljYpCDzP1ng92YH7nHlDFqeeG+JjMoqt/YbZdjDXTAi6vxB3uruFZqkj5ljX5W3jVOulQCB+TLNv5m1yEpDRYUD/v9gyIRXiwgbrqEC8AOPhl5XzjGOLd0kN/+NZHV/uXVAOUSkhBZgbph1K4GFBUnY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (4096-bit key) header.d=canonical.com header.i=@canonical.com header.b=PMVIdk8M; arc=none smtp.client-ip=185.125.188.123 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (4096-bit key) header.d=canonical.com header.i=@canonical.com header.b="PMVIdk8M" Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id D57D34012A for ; Wed, 21 Jan 2026 07:51:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1768981895; bh=mwIPbOci5oaCyF1RQyLgWXCMn5I/M1luBxKEhZcFZB8=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=PMVIdk8M5nP6R6TQOkf9K3W+c2O7BRLDw9uPgHWeeuQdfhqmCXm3N3B9jWHqRxTsN pyrig7sSr9nGypAGkOS1UUfZrR11+f7ypQ/jABQb3bhjclT68hKw0urWJW1sgnZEQt U1+gy/2xtc5eDtOV/lwmgLnbqcH/QRJiRqghvsoem8cA7Xb1eSCIgSxxzmF6y4K8za TH3jgbn5yiScO599fIqy/IBYUYQ8xK1PIzZoIRCywUIuh6Vnh0xLQgRgObq9nmEEP8 siboIVmfb+TVH//AmVfV6tGljRJiYOoCc2LM25n3fOoJF/rsPjpH6iwJ3HLCHNY18w ndCOshDuYlzPhxr08CxmwyC5q7+CkO4Fq0+YvFngKYEnBjjQ5SKoiqgru2R8yOJWbq 22eSVwBUj4H2u3zd0HE16buJaJH9GkniVK2QN2zi/A5/1nPkL9USjV9u+LYAdaCbpe sV+gHtw1cTYx1FqvuIEwUD3RvX6JbYIy31MU4f1+ztFswegTNLAMy36+1bfkbMWMbN vAdbtRy32lwKCZ9vZnmQn0it6gqaU7uI7+7ndv9zCfFRb51XkqCxIKHIx7XCeah1wD iS8HodvdF9uv2z6KtafDEziArjHqB7J71s4uOmUpoVXLMuNXsnPj8rVJsUuaVuawmz u4V7hpcUph5qMgqBginW5vPs= Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-47d5bd981c8so47511635e9.0 for ; Tue, 20 Jan 2026 23:51:35 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1768981895; x=1769586695; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=mwIPbOci5oaCyF1RQyLgWXCMn5I/M1luBxKEhZcFZB8=; b=U3lyioi2C+EIPHoKXKhMglH4Ft9JUofafp4YZvCghYc4Rl69n03FJZDD5QLvSZgzZz iV+ruW9cLP6qOdDwz2RkqiYqewvfp/xTJ1EeROIwJLTS73ToICgK++SC3kIYAmL1GoS8 Drh3MEagoiYKcLxIMovLVn2+3hQdyTubHE+lwls4LRVdMaQqiU1Kqe6lbrjOt35ldH8i iQqSZg/3e16eqFy62Yu7W3/N0jrmEPluf+kPDybyBl9JB1FJHDtD96Bsz09MPIfe9IU2 qWAhCAwtk1Kly0MbkOS81gauBMABDF+4UtV/JYeXoJ5XXfSKJsJsDP16IFmifYYJMBop pk5Q== X-Forwarded-Encrypted: i=1; AJvYcCXgM8y/NPtQQvBCKN9vLsEW6Id3MdiTChe/Np2WoUdz/omuTgyeOqgA0sRYyb+VNzCMdgX2tXXYaKTlyRk=@vger.kernel.org X-Gm-Message-State: AOJu0YyoCvSSA5kqmaOEyt0A8Z8kteFs22LoUN5s1pSdl/Q06W45e98Z P2/LtceRsMr8Tx75/5dFcem4gVST6w/mLuYOyaFBvtY70IuizRBv56lK/v6YUH3SwPeohT0vwYT TMd4pqIKIblI5dzDhPALoIqKNkjsy4kHjfCaWH80eY05YeymXFrmfulv1exFePZup0Whw9vBvvm FsP6laNfSuK+d7her0 X-Gm-Gg: AZuq6aLTw5pQp2kAH8c2KTSrLDaQ1eAXJI0PlfsHitagiNwQ1g77vobBd0jfoRghgWz Q2pmK40ogwV9kdrGj+28bNt7xJNl7VgRrDKDLVxAiq+V/hqbEPQSjUr/wj2BXWzxBC7W06Fgwxm 6O3/DLg6JHAVIulRLUy0HJlp8FVWhwxr/2TbACug2uDVykBLCT4qPLDP6vn+rxjIs2uEf57JGf/ ADNJNqYLAzDTcqcWJ2XAonP3Da/Ut+0coV6rW8KqERrkWxQm/CrMt5DeUVQ3HfrzuGVnN6zg3a9 zgKcQHb1dcrt44KnoTybwZqFVzdwvXiNOYJf57mX99jNPIkTOkKoKBukA0CdKvCt45niw5LOFXF NwP1refA3UwivDEpXaYTHEMzByA== X-Received: by 2002:a05:600c:4e90:b0:47e:e20e:bba3 with SMTP id 5b1f17b1804b1-4801eab54ccmr222724635e9.7.1768981895248; Tue, 20 Jan 2026 23:51:35 -0800 (PST) X-Received: by 2002:a05:600c:4e90:b0:47e:e20e:bba3 with SMTP id 5b1f17b1804b1-4801eab54ccmr222724165e9.7.1768981894784; Tue, 20 Jan 2026 23:51:34 -0800 (PST) Received: from localhost.localdomain ([103.155.100.12]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-47f428ac749sm356728735e9.5.2026.01.20.23.51.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 20 Jan 2026 23:51:34 -0800 (PST) From: Aaron Ma To: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] ice: Fix PTP NULL pointer dereference during VSI rebuild Date: Wed, 21 Jan 2026 15:51:06 +0800 Message-ID: <20260121075106.401770-1-aaron.ma@canonical.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix race condition where PTP periodic work runs while VSI is being rebuilt, accessing NULL vsi->rx_rings. The sequence was: 1. ice_ptp_prepare_for_reset() cancels PTP work 2. ice_ptp_rebuild() immediately queues PTP work 3. VSI rebuild happens AFTER ice_ptp_rebuild() 4. PTP work runs and accesses NULL vsi->rx_rings Fix: Keep PTP work cancelled during rebuild, only queue it after VSI rebuild completes in ice_rebuild(). Added ice_ptp_queue_work() helper function to encapsulate the logic for queuing PTP work, ensuring it's only queued when PTP is supported and the state is ICE_PTP_READY. Error log: [ 121.392544] ice 0000:60:00.1: PTP reset successful [ 121.392692] BUG: kernel NULL pointer dereference, address: 0000000000000= 000 [ 121.392712] #PF: supervisor read access in kernel mode [ 121.392720] #PF: error_code(0x0000) - not-present page [ 121.392727] PGD 0 [ 121.392734] Oops: Oops: 0000 [#1] SMP NOPTI [ 121.392746] CPU: 8 UID: 0 PID: 1005 Comm: ice-ptp-0000:60 Tainted: G S = 6.19.0-rc6+ #4 PREEMPT(voluntary) [ 121.392761] Tainted: [S]=3DCPU_OUT_OF_SPEC [ 121.392773] RIP: 0010:ice_ptp_update_cached_phctime+0xbf/0x150 [ice] [ 121.393042] Call Trace: [ 121.393047] [ 121.393055] ice_ptp_periodic_work+0x69/0x180 [ice] [ 121.393202] kthread_worker_fn+0xa2/0x260 [ 121.393216] ? __pfx_ice_ptp_periodic_work+0x10/0x10 [ice] [ 121.393359] ? __pfx_kthread_worker_fn+0x10/0x10 [ 121.393371] kthread+0x10d/0x230 [ 121.393382] ? __pfx_kthread+0x10/0x10 [ 121.393393] ret_from_fork+0x273/0x2b0 [ 121.393407] ? __pfx_kthread+0x10/0x10 [ 121.393417] ret_from_fork_asm+0x1a/0x30 [ 121.393432] Fixes: 803bef817807d ("ice: factor out ice_ptp_rebuild_owner()") Signed-off-by: Aaron Ma Tested-by: Sunitha Mekala (A Contingent worke= r at Intel) --- drivers/net/ethernet/intel/ice/ice_main.c | 3 +++ drivers/net/ethernet/intel/ice/ice_ptp.c | 26 ++++++++++++++++++----- drivers/net/ethernet/intel/ice/ice_ptp.h | 5 +++++ 3 files changed, 29 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethern= et/intel/ice/ice_main.c index 1851e9932cefe..2f5961573842d 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -7814,6 +7814,9 @@ static void ice_rebuild(struct ice_pf *pf, enum ice_r= eset_req reset_type) =20 /* Restore timestamp mode settings after VSI rebuild */ ice_ptp_restore_timestamp_mode(pf); + + /* Start PTP periodic work after VSI is fully rebuilt */ + ice_ptp_queue_work(pf); return; =20 err_vsi_rebuild: diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/etherne= t/intel/ice/ice_ptp.c index 4c8d20f2d2c0a..8e5d93acaf108 100644 --- a/drivers/net/ethernet/intel/ice/ice_ptp.c +++ b/drivers/net/ethernet/intel/ice/ice_ptp.c @@ -2817,6 +2817,20 @@ static void ice_ptp_periodic_work(struct kthread_wor= k *work) msecs_to_jiffies(err ? 10 : 500)); } =20 +/** + * ice_ptp_queue_work - Queue PTP periodic work for a PF + * @pf: Board private structure + * + * Helper function to queue PTP periodic work after VSI rebuild completes. + * This ensures that PTP work only runs when VSI structures are ready. + */ +void ice_ptp_queue_work(struct ice_pf *pf) +{ + if (test_bit(ICE_FLAG_PTP_SUPPORTED, pf->flags) && + pf->ptp.state =3D=3D ICE_PTP_READY) + kthread_queue_delayed_work(pf->ptp.kworker, &pf->ptp.work, 0); +} + /** * ice_ptp_prepare_rebuild_sec - Prepare second NAC for PTP reset or rebui= ld * @pf: Board private structure @@ -2835,10 +2849,15 @@ static void ice_ptp_prepare_rebuild_sec(struct ice_= pf *pf, bool rebuild, struct ice_pf *peer_pf =3D ptp_port_to_pf(port); =20 if (!ice_is_primary(&peer_pf->hw)) { - if (rebuild) + if (rebuild) { + /* TODO: When implementing rebuild=3Dtrue: + * 1. Ensure secondary PFs' VSIs are rebuilt + * 2. Call ice_ptp_queue_work(peer_pf) after VSI rebuild + */ ice_ptp_rebuild(peer_pf, reset_type); - else + } else { ice_ptp_prepare_for_reset(peer_pf, reset_type); + } } } } @@ -2984,9 +3003,6 @@ void ice_ptp_rebuild(struct ice_pf *pf, enum ice_rese= t_req reset_type) =20 ptp->state =3D ICE_PTP_READY; =20 - /* Start periodic work going */ - kthread_queue_delayed_work(ptp->kworker, &ptp->work, 0); - dev_info(ice_pf_to_dev(pf), "PTP reset successful\n"); return; =20 diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.h b/drivers/net/etherne= t/intel/ice/ice_ptp.h index 27016aac4f1e8..428f7f79343a7 100644 --- a/drivers/net/ethernet/intel/ice/ice_ptp.h +++ b/drivers/net/ethernet/intel/ice/ice_ptp.h @@ -317,6 +317,7 @@ void ice_ptp_prepare_for_reset(struct ice_pf *pf, void ice_ptp_init(struct ice_pf *pf); void ice_ptp_release(struct ice_pf *pf); void ice_ptp_link_change(struct ice_pf *pf, bool linkup); +void ice_ptp_queue_work(struct ice_pf *pf); #else /* IS_ENABLED(CONFIG_PTP_1588_CLOCK) */ =20 static inline int ice_ptp_hwtstamp_get(struct net_device *netdev, @@ -383,6 +384,10 @@ static inline void ice_ptp_link_change(struct ice_pf *= pf, bool linkup) { } =20 +static inline void ice_ptp_queue_work(struct ice_pf *pf) +{ +} + static inline int ice_ptp_clock_index(struct ice_pf *pf) { return -1; --=20 2.43.0