[PATCH iwl-net] ice: fix NULL dereference after disabling RDMA

[Vincent Choiniere via B4 Relay]

From: Vincent Choiniere <choiniere.vincent@xxxxxxxxxxxxxxx>

ice_deinit_rdma() checks ice_is_rdma_ena() before dereferencing
pf->cdev_info. While the enable_rdma devlink driverinit parameter is
registered, that helper returns the parameter value. Once the parameter
is unregistered, it falls back to ICE_FLAG_RDMA_ENA.

When enable_rdma is set to false and applied by a devlink reload,
ice_init_rdma() returns early, leaving pf->cdev_info NULL. During driver
removal, ice_remove() calls ice_deinit_devlink() before ice_unload().
The parameters are therefore unregistered before ice_deinit_rdma()
runs. On an RDMA-capable device, ice_is_rdma_ena() then returns true,
allowing ice_deinit_rdma() to dereference the NULL pointer.

This can cause a panic during reboot, module removal or PCI unbind.
Reproduced on an E810 PF with Ubuntu kernel 7.0.0-14 (PREEMPT_RT):

 devlink dev param set pci/0000:02:00.0 name enable_rdma value false \
         cmode driverinit
 devlink dev reload pci/0000:02:00.0 action driver_reinit
 systemctl reboot

 BUG: kernel NULL pointer dereference, address: 0000000000000018
 RIP: 0010:ice_deinit_rdma+0x30/0x60 [ice]
  ice_unload+0x3f/0x150 [ice]
  ice_remove+0xb5/0x1d0 [ice]
  ice_shutdown+0x1b/0x60 [ice]
  pci_device_shutdown
  device_shutdown
  kernel_restart
 Kernel panic - not syncing: Attempted to kill init!

Check pf->cdev_info before dereferencing it, as
ice_rdma_update_vsi_filter() already does. This preserves the existing
enable_rdma semantics without changing other ice_is_rdma_ena() callers.

Fixes: 87181cd6985f ("ice: enable_rdma devlink param")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Vincent Choiniere <choiniere.vincent@xxxxxxxxxxxxxxx>
---
Testing was performed on an E810 PF passed through to a KVM guest,
using Ubuntu kernel 7.0.0-38 (PREEMPT_RT). Two kernels differing only
by this patch were compared. Each test set enable_rdma=false and
applied it with devlink reload driver_reinit before the removal step.

  Removal path      Without patch           With patch
  reboot (x3)       NULL deref, panic (3/3) clean (3/3)
  rmmod ice         NULL deref              clean
  PCI unbind        NULL deref              clean

Additional checks on the patched kernel:
  - Reboot without a preceding devlink reload completed cleanly.
  - irdma devices returned after PCI unbind/bind.
  - irdma devices returned after an enable_rdma false -> true reload
    cycle.

No KASAN or kmemleak testing was performed.

The exact target tree (net, 7076f684d5132e6a) was not built or tested.
ice_deinit_rdma() and ice_is_rdma_ena() are unchanged there compared
with the tested code.
---
 drivers/net/ethernet/intel/ice/ice_idc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c b/drivers/net/ethernet/intel/ice/ice_idc.c
index 102d63c30..09dfcffeb 100644
--- a/drivers/net/ethernet/intel/ice/ice_idc.c
+++ b/drivers/net/ethernet/intel/ice/ice_idc.c
@@ -454,7 +454,7 @@ int ice_init_rdma(struct ice_pf *pf)
  */
 void ice_deinit_rdma(struct ice_pf *pf)
 {
-	if (!ice_is_rdma_ena(pf))
+	if (!ice_is_rdma_ena(pf) || !pf->cdev_info)
 		return;
 
 	xa_erase(&ice_aux_id, pf->aux_idx);

---
base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5
change-id: 20261025-ice-deinit-rdma-null-613f1be33f72