Merge branch 'net-mana-fix-null-dereferences-during-teardown-after-attach-failure'
authorJakub Kicinski <kuba@kernel.org>
Thu, 28 May 2026 23:33:45 +0000 (16:33 -0700)
committerJakub Kicinski <kuba@kernel.org>
Thu, 28 May 2026 23:33:45 +0000 (16:33 -0700)
commitab4ac5a93b1b76aa6b12cadcba30450868d21a6f
treeb19f7f767091dc36ff861907752ada81a3c8a841
parent3e20009988e2470063824c58b19d1c80816cc46d
parent5b05aa36ee24297d7296ca58dfd8c448d0e4cda3
Merge branch 'net-mana-fix-null-dereferences-during-teardown-after-attach-failure'

Dipayaan Roy says:

====================
net: mana: Fix NULL dereferences during teardown after attach failure

When mana_attach() fails (e.g. during queue allocation), the error
cleanup frees apc->tx_qp and apc->rxqs and sets them to NULL. Multiple
subsequent teardown paths can then dereference these NULL pointers,
causing kernel panics.

Patch 1 adds NULL guards in the low-level teardown functions
(mana_fence_rqs, mana_destroy_vport, mana_dealloc_queues) so they are
safe to call regardless of queue initialization state. This covers all
callers: mana_remove(), mana_change_mtu() recovery, and internal error
paths in mana_alloc_queues().

Patch 2 adds an early exit in mana_detach() for already-detached ports,
making it safe for non-close callers. This allows the queue reset
handler to safely retry mana_attach() without redundant teardown.
====================

Link: https://patch.msgid.link/20260525081129.1230035-1-dipayanroy@linux.microsoft.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>