> -----Original Message----- > From: Alexey Simakov <[email protected]> > Sent: Tuesday, July 7, 2026 8:20 PM > To: John Daley (johndale) <[email protected]>; Hyong Youb Kim (hyonkim) > <[email protected]>; Sujith Sankar <[email protected]>; David Marchand > <[email protected]>; Neil Horman <[email protected]> > Cc: [email protected]; [email protected]; Alexey Simakov <[email protected]> > Subject: [PATCH] net/enic: fix possible null dereference in notify set > > The memset of notify_addr in vnic_dev_notify_setcmd() was performed > unconditionally before the device reset check. When the device is in > reset, vnic_dev_notify_set() skips the notification buffer allocation, > leaving notify_addr as NULL. The subsequent call to > vnic_dev_notify_setcmd() would then dereference the NULL pointer via > memset. > > Move the memset inside the existing !vnic_dev_in_reset() guard where > notify_addr is guaranteed to be valid. > > Fixes: 9913fbb91df0 ("enic/base: common code") > Cc: [email protected] > > Signed-off-by: Alexey Simakov <[email protected]> > --- > drivers/net/enic/base/vnic_dev.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/net/enic/base/vnic_dev.c > b/drivers/net/enic/base/vnic_dev.c > index ba8ecc16f2..e6d34622af 100644 > --- a/drivers/net/enic/base/vnic_dev.c > +++ b/drivers/net/enic/base/vnic_dev.c > @@ -964,8 +964,8 @@ int vnic_dev_notify_setcmd(struct vnic_dev *vdev, > int wait = 1000; > int r; > > - memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify)); > if (!vnic_dev_in_reset(vdev)) { > + memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify)); > vdev->notify = notify_addr; > vdev->notify_pa = notify_pa;
notify_addr == NULL (or bogus notify_pa) is a hard program error in this function. Debug assertion might be more appropriate to make the intention clear. During init, the driver allocates the notify buffer while in_reset == 0. enic_dev_init() does not check the return code from vnic_dev_notify_set(). I think that needs to be fixed. Thanks. -Hyong > } > -- > 2.34.1
