From nobody Wed Oct 07 14:05:08 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4j0FJ94wsHz6vxy6 for ; Wed, 07 Oct 2026 14:05:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4j0FJ92kP5z3NYm for ; Wed, 07 Oct 2026 14:05:13 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791381913; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JHelzC7mZUXJtfYPX6UnQ9TfkwOZSY3l2t+0hR2MVLY=; b=b/dYkEfneJHfKRwWpQwimWiH/ARpk91OTd6ZQnLrIdrNT+Snc307iUNVcz37sZ8x9R3ADD ayw7VNJBeh8gSqInU3cnh8tUbyQPYTWgsd8kSn9dksn8ZVne5Pe0ZmzX3ZK3PemdQmMWhl yrwAPYC9jUnz5Dhc1EDtZZXbKLC/34/RP4pMeNTxidi7/GY4V4PbsAm0/01HVj4TNf9OTE tNFqfFKfeP/xyi42cK4vBKaFzGjT8mUrIm1/Nnk2xFOFsZl9I27T8iyGYPHwHDoBpnP0PZ sVlMNrH7Yv3408qQ5VmkjalUcMsDor9rG7aif1agKz1Igz58zBpHeL7gK/2MCA== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791381913; b=DOw5n9xmRQzSK8anS98hoGdyXcoqnd84J/yDsvLWQOaSO2mxe+RZd5oFIqKu1jb/6J9M/0 rHef5bQoAZsYj55MkXjUzeMM17I8vla/g+oGY+WQeYnCA5gtJZ1qsBuh0Mk15TasFZ37cF 3o6Xapc5aOpIOr+a0j8NWjfI+6VbldJsxKvdDNQdG1JKTCjlE8LMHFqHWKEw4JmKCRex9a 1Ao7qIvaZ3jXWCHTt6gtxkCK08iD9qW2cdLkrLUXFi5t3mMUaXOI+RIUmuA8x82tC8gLzK aB5ToA5E0OFzECNWb1RS9cpeqAKw1BxZugfxSvqJ4/w6QAK+r7uTyYSvRAOXYQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791381913; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JHelzC7mZUXJtfYPX6UnQ9TfkwOZSY3l2t+0hR2MVLY=; b=phmc92ZjeT7iBXwK/Ch38d4Z6XfJwk11bLwSlyyu3kdIYoFwPzNuD2dTlXhg9ZFrJpRwWb hZYP5vuLw+GPR6SCetp6KEhyjB4fstyvKS3ZoFcZkxAwIbein3T7WibACOj6HEShvImEJL jKXVKCVu+UZAOPhZnxFHkBCAfJ5zNaZChRSc+o6lwF3enBaw2UFi5fr7GgZO2+MdCjYVZV xhan9bv0HMt4sUP5LaGkxcWWkjBidPZ9GgULUve0MKFo/Pw/kBOAV2xRrg0mWeKdosW6xp nzHLdkWD05QxDJpbQ6fwmIfy62y7CEtYzCXV+NXU5Ag6xehuPuAp0Z8SyI9Xvg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4j0FJ91Js1zwJS for ; Wed, 07 Oct 2026 14:05:13 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1c097 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 07 Oct 2026 14:05:08 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Cc: Jasper Tran O'Leary From: Mark Johnston Subject: git: d45b063c06d4 - main - gve: fix kernel panic on attach failure List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: d45b063c06d46d0f43489708e226821cddbad53b Auto-Submitted: auto-generated Date: Wed, 07 Oct 2026 14:05:08 +0000 Message-Id: <6ac65194.1c097.ed4c373@gitrepo.freebsd.org> The branch main has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=d45b063c06d46d0f43489708e226821cddbad53b commit d45b063c06d46d0f43489708e226821cddbad53b Author: Jasper Tran O'Leary AuthorDate: 2026-10-07 13:29:28 +0000 Commit: Mark Johnston CommitDate: 2026-10-07 13:29:40 +0000 gve: fix kernel panic on attach failure When device initialization fails during attach (for instance, if device resource configuration or firmware negotiation fails), the driver aborts and unrolls partial state via its detach routine. However, the teardown path assumes transmit and receive queues have already been created. If attach aborts before queue allocation, tearing down the uninitialized queues triggers a NULL pointer dereference and panics the kernel during boot. Guard queue teardown against uninitialized queue state so that early attach failures unwind safely, allowing the driver to report the failure gracefully without crashing the operating system. Signed-off-by: Jasper Tran O'Leary Reviewed by: adrian, markj MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D60385 --- sys/dev/gve/gve_main.c | 16 ++++++++++------ sys/dev/gve/gve_rx.c | 3 +++ sys/dev/gve/gve_tx.c | 3 +++ 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/sys/dev/gve/gve_main.c b/sys/dev/gve/gve_main.c index 10197a8e15f8..fc88b3dfd014 100644 --- a/sys/dev/gve/gve_main.c +++ b/sys/dev/gve/gve_main.c @@ -694,13 +694,17 @@ gve_free_rings(struct gve_priv *priv) { gve_free_irqs(priv); - gve_free_tx_rings(priv, 0, priv->tx_cfg.num_queues); - free(priv->tx, M_GVE); - priv->tx = NULL; + if (priv->tx != NULL) { + gve_free_tx_rings(priv, 0, priv->tx_cfg.num_queues); + free(priv->tx, M_GVE); + priv->tx = NULL; + } - gve_free_rx_rings(priv, 0, priv->rx_cfg.num_queues); - free(priv->rx, M_GVE); - priv->rx = NULL; + if (priv->rx != NULL) { + gve_free_rx_rings(priv, 0, priv->rx_cfg.num_queues); + free(priv->rx, M_GVE); + priv->rx = NULL; + } } static int diff --git a/sys/dev/gve/gve_rx.c b/sys/dev/gve/gve_rx.c index de64375ac4f3..8d3f1e2a68d9 100644 --- a/sys/dev/gve/gve_rx.c +++ b/sys/dev/gve/gve_rx.c @@ -209,6 +209,9 @@ gve_free_rx_rings(struct gve_priv *priv, uint16_t start_idx, uint16_t stop_idx) { int i; + if (priv->rx == NULL) + return; + for (i = start_idx; i < stop_idx; i++) gve_rx_free_ring(priv, i); } diff --git a/sys/dev/gve/gve_tx.c b/sys/dev/gve/gve_tx.c index 5e0611e1d6e4..53451acc1934 100644 --- a/sys/dev/gve/gve_tx.c +++ b/sys/dev/gve/gve_tx.c @@ -207,6 +207,9 @@ gve_free_tx_rings(struct gve_priv *priv, uint16_t start_idx, uint16_t stop_idx) { int i; + if (priv->tx == NULL) + return; + for (i = start_idx; i < stop_idx; i++) gve_tx_free_ring(priv, i); }