| Message ID | 20240625130314.2661257-1-make24@iscas.ac.cn (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1864b8224195d0e43ddb92a8151f54f6562090cc |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [v3] net: mana: Fix possible double free in error handling path | expand |
Hello: This patch was applied to netdev/net.git (main) by Paolo Abeni <pabeni@redhat.com>: On Tue, 25 Jun 2024 21:03:14 +0800 you wrote: > When auxiliary_device_add() returns error and then calls > auxiliary_device_uninit(), callback function adev_release > calls kfree(madev). We shouldn't call kfree(madev) again > in the error handling path. Set 'madev' to NULL. > > Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") > Signed-off-by: Ma Ke <make24@iscas.ac.cn> > > [...] Here is the summary with links: - [v3] net: mana: Fix possible double free in error handling path https://git.kernel.org/netdev/net/c/1864b8224195 You are awesome, thank you!
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c index d087cf954f75..608ad31a9702 100644 --- a/drivers/net/ethernet/microsoft/mana/mana_en.c +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c @@ -2798,6 +2798,8 @@ static int add_adev(struct gdma_dev *gd) if (ret) goto init_fail; + /* madev is owned by the auxiliary device */ + madev = NULL; ret = auxiliary_device_add(adev); if (ret) goto add_fail;
When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function adev_release calls kfree(madev). We shouldn't call kfree(madev) again in the error handling path. Set 'madev' to NULL. Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") Signed-off-by: Ma Ke <make24@iscas.ac.cn> --- Changes in v3: - added a "Fixes" line as suggested. Changes in v2: - streamlined the patch according suggestions; - revised the description. --- drivers/net/ethernet/microsoft/mana/mana_en.c | 2 ++ 1 file changed, 2 insertions(+)