From: Kiran Patil During a concurrent reset, q_vectors are freed and re-allocated while the watchdog task may still be iterating rings in iavf_detect_recover_hung(). Dereferencing a NULL q_vector inside iavf_force_wb() results in a crash. Guard against this by skipping rings whose q_vector is NULL. Also move the tx_ring declaration into the loop body and drop the redundant outer NULL initialisation, which the compiler can never observe since an array-element address is always non-NULL. Fixes: 9c6c12595b73 ("i40e: Detection and recovery of TX queue hung logic moved to service_task from tx_timeout") Signed-off-by: Kiran Patil Signed-off-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/iavf/iavf_txrx.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c index 363c42b..e7e7fc9 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c +++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c @@ -176,7 +176,6 @@ static void iavf_force_wb(struct iavf_vsi *vsi, struct iavf_q_vector *q_vector) **/ void iavf_detect_recover_hung(struct iavf_vsi *vsi) { - struct iavf_ring *tx_ring = NULL; struct net_device *netdev; unsigned int i; int packets; @@ -195,8 +194,11 @@ void iavf_detect_recover_hung(struct iavf_vsi *vsi) return; for (i = 0; i < vsi->back->num_active_queues; i++) { - tx_ring = &vsi->back->tx_rings[i]; - if (tx_ring && tx_ring->desc) { + struct iavf_ring *tx_ring = &vsi->back->tx_rings[i]; + + if (!tx_ring || !tx_ring->q_vector) + continue; + if (tx_ring->desc) { /* If packet counter has not changed the queue is * likely stalled, so force an interrupt for this * queue. -- 2.52.0