rhashtable_walk_next() can return ERR_PTR(-EAGAIN) when the table is resized. efx_mae_lookup_mport() currently dereferences that value as an mport descriptor. Skip error values and continue the walk, as the other rhashtable walkers in this driver already do. Fixes: 5227adff37af ("sfc: add mport lookup based on driver's mport data") Reported-by: Changyul Lee Assisted-by: LLM Signed-off-by: Sang-Hoon Choi --- Compile-tested the affected object with x86_64 allmodconfig and W=1 (GCC 13.3.0). Base: mainline 3b7cab693ba2bab63774bf5b988e8a61b2ef0f32. No hardware testing or runtime failure reproduction was performed. drivers/net/ethernet/sfc/mae.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/sfc/mae.c b/drivers/net/ethernet/sfc/mae.c index 7a8606efd492..b6de61062a86 100644 --- a/drivers/net/ethernet/sfc/mae.c +++ b/drivers/net/ethernet/sfc/mae.c @@ -1030,6 +1030,8 @@ int efx_mae_lookup_mport(struct efx_nic *efx, u32 vf_idx, u32 *id) rhashtable_walk_enter(&mae->mports_ht, &walk); rhashtable_walk_start(&walk); while ((m = rhashtable_walk_next(&walk)) != NULL) { + if (IS_ERR(m)) + continue; if (m->mport_type == MAE_MPORT_DESC_MPORT_TYPE_VNIC && m->interface_idx == nic_data->local_mae_intf && m->pf_idx == 0 &&