[PATCH] bnx2x: fix double free in bnx2x_init_firmware() error path

[PATCH] bnx2x: fix double free in bnx2x_init_firmware() error path

[Jiangshan Yi]

bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
bp->init_ops_offsets in its error path without setting them to NULL.
The cleanup function bnx2x_release_firmware() frees the same three
pointers unconditionally, so if init_firmware fails and
release_firmware is later called (e.g. from __bnx2x_remove or through
the function state machine), all three are freed a second time.

Set each pointer to NULL after kfree() in the error path so that the
subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.

Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 208a894d6190..39eb6ab5f805 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13473,10 +13473,13 @@ static int bnx2x_init_firmware(struct bnx2x *bp)
 
 iro_alloc_err:
 	kfree(bp->init_ops_offsets);
+	bp->init_ops_offsets = NULL;
 init_offsets_alloc_err:
 	kfree(bp->init_ops);
+	bp->init_ops = NULL;
 init_ops_alloc_err:
 	kfree(bp->init_data);
+	bp->init_data = NULL;
 request_firmware_exit:
 	release_firmware(bp->firmware);
 	bp->firmware = NULL;
-- 
2.25.1

Re: [PATCH] bnx2x: fix double free in bnx2x_init_firmware() error path

[Simon Horman]

On Sat, Aug 15, 2026 at 08:21:49PM +0800, Jiangshan Yi wrote:
> bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
> bp->init_ops_offsets in its error path without setting them to NULL.
> The cleanup function bnx2x_release_firmware() frees the same three
> pointers unconditionally, so if init_firmware fails and
> release_firmware is later called (e.g. from __bnx2x_remove or through
> the function state machine), all three are freed a second time.
> 
> Set each pointer to NULL after kfree() in the error path so that the
> subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
> 
> Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>

Reviewed-by: Simon Horman <horms@kernel.org>