From: Vincent Choiniere ice_deinit_rdma() checks ice_is_rdma_ena() before dereferencing pf->cdev_info. While the enable_rdma devlink driverinit parameter is registered, that helper returns the parameter value. Once the parameter is unregistered, it falls back to ICE_FLAG_RDMA_ENA. When enable_rdma is set to false and applied by a devlink reload, ice_init_rdma() returns early, leaving pf->cdev_info NULL. During driver removal, ice_remove() calls ice_deinit_devlink() before ice_unload(). The parameters are therefore unregistered before ice_deinit_rdma() runs. On an RDMA-capable device, ice_is_rdma_ena() then returns true, allowing ice_deinit_rdma() to dereference the NULL pointer. This can cause a panic during reboot, module removal or PCI unbind. Reproduced on an E810 PF with Ubuntu kernel 7.0.0-14 (PREEMPT_RT): devlink dev param set pci/0000:02:00.0 name enable_rdma value false \ cmode driverinit devlink dev reload pci/0000:02:00.0 action driver_reinit systemctl reboot BUG: kernel NULL pointer dereference, address: 0000000000000018 RIP: 0010:ice_deinit_rdma+0x30/0x60 [ice] ice_unload+0x3f/0x150 [ice] ice_remove+0xb5/0x1d0 [ice] ice_shutdown+0x1b/0x60 [ice] pci_device_shutdown device_shutdown kernel_restart Kernel panic - not syncing: Attempted to kill init! Check pf->cdev_info before dereferencing it, as ice_rdma_update_vsi_filter() already does. This preserves the existing enable_rdma semantics without changing other ice_is_rdma_ena() callers. Fixes: 87181cd6985f ("ice: enable_rdma devlink param") Cc: stable@vger.kernel.org Signed-off-by: Vincent Choiniere --- Testing was performed on an E810 PF passed through to a KVM guest, using Ubuntu kernel 7.0.0-38 (PREEMPT_RT). Two kernels differing only by this patch were compared. Each test set enable_rdma=false and applied it with devlink reload driver_reinit before the removal step. Removal path Without patch With patch reboot (x3) NULL deref, panic (3/3) clean (3/3) rmmod ice NULL deref clean PCI unbind NULL deref clean Additional checks on the patched kernel: - Reboot without a preceding devlink reload completed cleanly. - irdma devices returned after PCI unbind/bind. - irdma devices returned after an enable_rdma false -> true reload cycle. No KASAN or kmemleak testing was performed. The exact target tree (net, 7076f684d5132e6a) was not built or tested. ice_deinit_rdma() and ice_is_rdma_ena() are unchanged there compared with the tested code. --- drivers/net/ethernet/intel/ice/ice_idc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c b/drivers/net/ethernet/intel/ice/ice_idc.c index 102d63c30..09dfcffeb 100644 --- a/drivers/net/ethernet/intel/ice/ice_idc.c +++ b/drivers/net/ethernet/intel/ice/ice_idc.c @@ -454,7 +454,7 @@ int ice_init_rdma(struct ice_pf *pf) */ void ice_deinit_rdma(struct ice_pf *pf) { - if (!ice_is_rdma_ena(pf)) + if (!ice_is_rdma_ena(pf) || !pf->cdev_info) return; xa_erase(&ice_aux_id, pf->aux_idx); --- base-commit: 7076f684d5132e6a6145e1da2fa74771ecd052e5 change-id: 20261025-ice-deinit-rdma-null-613f1be33f72