From nobody Thu Oct 22 17:32:24 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBJ4RVDz6xPh0 for ; Thu, 22 Oct 2026 17:32:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 4j9YBJ15dFz3Hmh for ; Thu, 22 Oct 2026 17:32:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WBVcyBO1ZMSBt4CFQLlXKGzSJTO6d+Z1WbfqCAtRg9g=; b=UtI36HvP23r+vYGTlmt6N6yTMZg3eonLGHK8c727FiuGB9yA0gsOxzb7qhQ+fmve4EOxER FwuSmhC7+o3lPeARb3rd0HVfwk8h/PUEvYSbejCQK5H8bbKjDhPIhgA7XhVVZXN+2GAtiw WaFPJvtDbFD5ETYBIwdtRA3hFnmoBYn98ibhP7O+PrypQd0uphcYBrd5mpIK++QDy79ai5 lVa+Em5c0+cDYz6/akqdT6EV/Et9KaKGlWo1Q+qLd0iWA+IoqZMA3xNm72RNuDhHuqd3jT JqWnnkfGSwmMpR6mUonakVI0qxvwy5r618S94NzYl+Sbrv77mDxmz6WwOzrXXg== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1792690344; b=SNmXP7mMY7oJR3PqaC5kO59B0FYdB2WjU/tcx4cHx6kmNHA2lbKHCkabkisjDk0CKc1G9m +CZOPQgjptzLy4GomU3YSQXtY5yI1p7oCiQ2N+6DkU05/RPZvxId5CXv6qwZLebs/sf64H +GRlv4gdHecpGezGqBE7aRUBKdl084OZsKnJYFQ6JSzsbDh1Bf8UghE4+NH+Wt/kbFPtSd 8T3ga9L40j8EJq5T8DELGgcnETssxYYArYXY+ojZHmn+GYuhg+awvo+FFxQ2n4Sn2dzqkO UcCx/4gWnUcXsslIGJI3dBAbHxSZwE11mC2gJN8NZebR6ZodjaO0gPaNyirFzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1792690344; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=WBVcyBO1ZMSBt4CFQLlXKGzSJTO6d+Z1WbfqCAtRg9g=; b=llJXAvnl6DANpDK9kZe3ad3cKcwHZsLslROrL7Vbh45mg+qRvtRybkZ+l9JONeCz81DZqo xvMoB8G5gTIHBSLbRLU0bPplMZqAvSiyablxeqx/Z46IJY0XLXDyjPS9mmxogd2UiV/7J4 lmxe3B5ji9f+otzSltdx/Z9YUYfUFjbq8gOmd2BldKuGUzQw5/MWkqdPV1Br82+u51b7vu Y2jesCkTHmDQXtHS7qwSXrp8lIgDYZ4qcSkrUcrmNFl61sp/pAkQ7pU/L4eLM2KQ1eLkVF NDyJHByreQBOFyki6hAnJxr5Bdi6BST8tgWDOBuUeVOn0Uz1OLL1m+B1kYLg7w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j9YBJ0g6fzsJT for ; Thu, 22 Oct 2026 17:32:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3ddd1 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Thu, 22 Oct 2026 17:32:24 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Cc: Jasper Tran O'Leary From: Mark Johnston Subject: git: 8aee0c376754 - stable/15 - gve: fix kernel panic on attach failure List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: Commit messages for all branches of the src repository List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 8aee0c376754dd9fb3123d81f24129920c42690b Auto-Submitted: auto-generated Date: Thu, 22 Oct 2026 17:32:24 +0000 Message-Id: <6ada48a8.3ddd1.4c5e1b97@gitrepo.freebsd.org> The branch stable/15 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=8aee0c376754dd9fb3123d81f24129920c42690b commit 8aee0c376754dd9fb3123d81f24129920c42690b Author: Jasper Tran O'Leary AuthorDate: 2026-10-07 13:29:28 +0000 Commit: Mark Johnston CommitDate: 2026-10-22 15:45:42 +0000 gve: fix kernel panic on attach failure When device initialization fails during attach (for instance, if device resource configuration or firmware negotiation fails), the driver aborts and unrolls partial state via its detach routine. However, the teardown path assumes transmit and receive queues have already been created. If attach aborts before queue allocation, tearing down the uninitialized queues triggers a NULL pointer dereference and panics the kernel during boot. Guard queue teardown against uninitialized queue state so that early attach failures unwind safely, allowing the driver to report the failure gracefully without crashing the operating system. Signed-off-by: Jasper Tran O'Leary Reviewed by: adrian, markj MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D60385 (cherry picked from commit d45b063c06d46d0f43489708e226821cddbad53b) --- sys/dev/gve/gve_main.c | 16 ++++++++++------ sys/dev/gve/gve_rx.c | 3 +++ sys/dev/gve/gve_tx.c | 3 +++ 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/sys/dev/gve/gve_main.c b/sys/dev/gve/gve_main.c index 10197a8e15f8..fc88b3dfd014 100644 --- a/sys/dev/gve/gve_main.c +++ b/sys/dev/gve/gve_main.c @@ -694,13 +694,17 @@ gve_free_rings(struct gve_priv *priv) { gve_free_irqs(priv); - gve_free_tx_rings(priv, 0, priv->tx_cfg.num_queues); - free(priv->tx, M_GVE); - priv->tx = NULL; + if (priv->tx != NULL) { + gve_free_tx_rings(priv, 0, priv->tx_cfg.num_queues); + free(priv->tx, M_GVE); + priv->tx = NULL; + } - gve_free_rx_rings(priv, 0, priv->rx_cfg.num_queues); - free(priv->rx, M_GVE); - priv->rx = NULL; + if (priv->rx != NULL) { + gve_free_rx_rings(priv, 0, priv->rx_cfg.num_queues); + free(priv->rx, M_GVE); + priv->rx = NULL; + } } static int diff --git a/sys/dev/gve/gve_rx.c b/sys/dev/gve/gve_rx.c index de64375ac4f3..8d3f1e2a68d9 100644 --- a/sys/dev/gve/gve_rx.c +++ b/sys/dev/gve/gve_rx.c @@ -209,6 +209,9 @@ gve_free_rx_rings(struct gve_priv *priv, uint16_t start_idx, uint16_t stop_idx) { int i; + if (priv->rx == NULL) + return; + for (i = start_idx; i < stop_idx; i++) gve_rx_free_ring(priv, i); } diff --git a/sys/dev/gve/gve_tx.c b/sys/dev/gve/gve_tx.c index 84e3a4c4eb9f..1fe7c7b21912 100644 --- a/sys/dev/gve/gve_tx.c +++ b/sys/dev/gve/gve_tx.c @@ -207,6 +207,9 @@ gve_free_tx_rings(struct gve_priv *priv, uint16_t start_idx, uint16_t stop_idx) { int i; + if (priv->tx == NULL) + return; + for (i = start_idx; i < stop_idx; i++) gve_tx_free_ring(priv, i); }