idpf_idc_vport_dev_ctrl(adapter, false) sets vport->vdev_info->adev
to NULL but keeps vport->vdev_info itself. An MTU change after that
calls idpf_idc_vdev_mtu_event(), which derefs vdev_info->adev for
device_lock() before reaching the (!adev || ...) check.

NULL-check vdev_info->adev before locking.

Fixes: ed6e1c8796a4 ("idpf: implement IDC vport aux driver MTU change handler")
Cc: stable@vger.kernel.org
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 drivers/net/ethernet/intel/idpf/idpf_idc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_idc.c b/drivers/net/ethernet/intel/idpf/idpf_idc.c
index b7d6b08fc89e..3ba52a80d52f 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_idc.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_idc.c
@@ -162,9 +162,12 @@ void idpf_idc_vdev_mtu_event(struct iidc_rdma_vport_dev_info *vdev_info,
 
 	set_bit(event_type, event.type);
 
+	if (!vdev_info->adev)
+		return;
+
 	device_lock(&vdev_info->adev->dev);
 	adev = vdev_info->adev;
-	if (!adev || !adev->dev.driver)
+	if (!adev->dev.driver)
 		goto unlock;
 	iadrv = container_of(adev->dev.driver,
 			     struct iidc_rdma_vport_auxiliary_drv,
-- 
2.53.0

On 5/10/2026 5:07 AM, David Carlier wrote:
> idpf_idc_vport_dev_ctrl(adapter, false) sets vport->vdev_info->adev
> to NULL but keeps vport->vdev_info itself. An MTU change after that
> calls idpf_idc_vdev_mtu_event(), which derefs vdev_info->adev for
> device_lock() before reaching the (!adev || ...) check.
> 
> NULL-check vdev_info->adev before locking.
> 
> Fixes: ed6e1c8796a4 ("idpf: implement IDC vport aux driver MTU change handler")
> Cc:stable@vger.kernel.org
> Signed-off-by: David Carlier<devnexen@gmail.com>
> ---
>   drivers/net/ethernet/intel/idpf/idpf_idc.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_idc.c b/drivers/net/ethernet/intel/idpf/idpf_idc.c
> index b7d6b08fc89e..3ba52a80d52f 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_idc.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_idc.c
> @@ -162,9 +162,12 @@ void idpf_idc_vdev_mtu_event(struct iidc_rdma_vport_dev_info *vdev_info,
>   
>   	set_bit(event_type, event.type);
>   
> +	if (!vdev_info->adev)
> +		return;
> +
>   	device_lock(&vdev_info->adev->dev);
>   	adev = vdev_info->adev;
> -	if (!adev || !adev->dev.driver)
> +	if (!adev->dev.driver)
>   		goto unlock;
>   	iadrv = container_of(adev->dev.driver,
>   			     struct iidc_rdma_vport_auxiliary_drv,
> -- 


It still reads vdev_info->adev twice.

better to cache it locally and use

	adev = READ_ONCE(vdev_info->adev);

         if (!adev)
                 return;

         device_lock(&adev->dev);

         if (!adev->dev.driver)
                 goto unlock;

Thanks,
Alok