From: Tian Xun Ng mbx_task keeps handling mailbox events while idpf_deinit_task() releases the vports: it requeues itself, or is queued from the mailbox interrupt, until idpf_vc_core_deinit() cancels it once the vports are gone. A VIRTCHNL2_EVENT_LINK_CHANGE event handled in that window looks its vport up in adapter->vports[] without a lock, and idpf_vport_dealloc() releases the netdev and frees the vport before it clears that slot, so idpf_handle_event_link() can follow a NULL netdev pointer or use the freed vport. Make idpf_handle_event_link() return once IDPF_REMOVE_IN_PROG is set. The previous patch waits for a running mbx_task after the bit is set and before anything is released, so on remove a link event is either handled before the vports are torn down or ignored. Shutdown has the same window today; the last patch of this series sets the bit there as well. The window also remains on a hard reset, which tears the vports down without setting the bit; that path is not changed here. Fixes: 02cbfba1add5 ("idpf: add ethtool callbacks") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Tian Xun Ng --- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c index d0db60647..2cfd216ae 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c @@ -40,6 +40,10 @@ static void idpf_handle_event_link(struct idpf_adapter *adapter, struct idpf_netdev_priv *np; struct idpf_vport *vport; + /* The vports are released on remove and shutdown */ + if (test_bit(IDPF_REMOVE_IN_PROG, adapter->flags)) + return; + vport = idpf_vid_to_vport(adapter, le32_to_cpu(v2e->vport_id)); if (!vport) { dev_err_ratelimited(&adapter->pdev->dev, "Failed to find vport_id %d for link event\n", -- 2.50.1 (Apple Git-155)