[PATCH net] bnge: Fix NULL pointer dereference in aux device release

[PATCH net] bnge: Fix NULL pointer dereference in aux device release

[Alok Tiwari]

If allocation of auxr_dev fails during auxiliary device setup, the error
path calls auxiliary_device_uninit(), which eventually invokes
bnge_aux_dev_release().

The release callback unconditionally dereferences aux_priv->auxr_dev->pdev
to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated
on this failure path, the dereference results in a NULL pointer exception

Retrieve the parent bnge_dev from the auxiliary device's parent instead of
auxr_dev, and free auxr_dev only when it was successfully allocated. This
allows the release callback to correctly clean up partially initialized
auxiliary devices.

Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support")
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c b/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
index 67e93e17d4d9..0955b488b6fe 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
@@ -141,12 +141,15 @@ static void bnge_aux_dev_release(struct device *dev)
 {
 	struct bnge_auxr_priv *aux_priv =
 			container_of(dev, struct bnge_auxr_priv, aux_dev.dev);
-	struct bnge_dev *bd = pci_get_drvdata(aux_priv->auxr_dev->pdev);
+	struct bnge_auxr_dev *auxr_dev = aux_priv->auxr_dev;
+	struct bnge_dev *bd = pci_get_drvdata(to_pci_dev(dev->parent));
 
 	ida_free(&bnge_aux_dev_ids, aux_priv->id);
-	kfree(aux_priv->auxr_dev->auxr_info);
+	if (auxr_dev) {
+		kfree(auxr_dev->auxr_info);
+		kfree(auxr_dev);
+	}
 	bd->auxr_dev = NULL;
-	kfree(aux_priv->auxr_dev);
 	kfree(aux_priv);
 	bd->aux_priv = NULL;
 }
-- 
2.52.0

Re: [PATCH net] bnge: Fix NULL pointer dereference in aux device release

[Bhargava Chenna Marreddy]

[-- Attachment #1: Type: text/plain, Size: 2143 bytes --]

On Sat, Aug 1, 2026 at 12:53 AM Alok Tiwari <alok.a.tiwari@oracle.com> wrote:
>
> If allocation of auxr_dev fails during auxiliary device setup, the error
> path calls auxiliary_device_uninit(), which eventually invokes
> bnge_aux_dev_release().
>
> The release callback unconditionally dereferences aux_priv->auxr_dev->pdev
> to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated
> on this failure path, the dereference results in a NULL pointer exception
>
> Retrieve the parent bnge_dev from the auxiliary device's parent instead of
> auxr_dev, and free auxr_dev only when it was successfully allocated. This
> allows the release callback to correctly clean up partially initialized
> auxiliary devices.
>
> Fixes: 8ac050ec3b1c ("bng_en: Add RoCE aux device support")
> Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>

Reviewed-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>

> ---
>  drivers/net/ethernet/broadcom/bnge/bnge_auxr.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c b/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
> index 67e93e17d4d9..0955b488b6fe 100644
> --- a/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
> +++ b/drivers/net/ethernet/broadcom/bnge/bnge_auxr.c
> @@ -141,12 +141,15 @@ static void bnge_aux_dev_release(struct device *dev)
>  {
>         struct bnge_auxr_priv *aux_priv =
>                         container_of(dev, struct bnge_auxr_priv, aux_dev.dev);
> -       struct bnge_dev *bd = pci_get_drvdata(aux_priv->auxr_dev->pdev);
> +       struct bnge_auxr_dev *auxr_dev = aux_priv->auxr_dev;
> +       struct bnge_dev *bd = pci_get_drvdata(to_pci_dev(dev->parent));
>
>         ida_free(&bnge_aux_dev_ids, aux_priv->id);
> -       kfree(aux_priv->auxr_dev->auxr_info);
> +       if (auxr_dev) {
> +               kfree(auxr_dev->auxr_info);
> +               kfree(auxr_dev);
> +       }
>         bd->auxr_dev = NULL;
> -       kfree(aux_priv->auxr_dev);
>         kfree(aux_priv);
>         bd->aux_priv = NULL;
>  }
> --
> 2.52.0
>
>

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5496 bytes --]

Re: [PATCH net] bnge: Fix NULL pointer dereference in aux device release

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 31 Jul 2026 12:22:59 -0700 you wrote:
> If allocation of auxr_dev fails during auxiliary device setup, the error
> path calls auxiliary_device_uninit(), which eventually invokes
> bnge_aux_dev_release().
> 
> The release callback unconditionally dereferences aux_priv->auxr_dev->pdev
> to retrieve the parent bnge_dev. Since auxr_dev has not yet been allocated
> on this failure path, the dereference results in a NULL pointer exception
> 
> [...]

Here is the summary with links:
  - [net] bnge: Fix NULL pointer dereference in aux device release
    https://git.kernel.org/netdev/net/c/1cb4298810e2

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html