From: Ma Ke <make24@iscas.ac.cn>
To: anthony.l.nguyen@intel.com, przemyslaw.kitszel@intel.com,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
pabeni@redhat.com, shiraz.saleem@intel.com,
david.m.ertman@intel.com
Cc: netdev@vger.kernel.org, stable@vger.kernel.org,
intel-wired-lan@lists.osuosl.org, linux-kernel@vger.kernel.org,
Ma Ke <make24@iscas.ac.cn>
Subject: [Intel-wired-lan] [PATCH] ice: Fix possible double free in error handling path
Date: Fri, 30 Aug 2024 21:33:24 +0800 [thread overview]
Message-ID: <20240830133325.3439293-1-make24@iscas.ac.cn> (raw)
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function adev_release
calls kfree(iadev). We shouldn't call kfree(iadev) again
in the error handling path. Set 'iadev' to NULL.
Cc: stable@vger.kernel.org
Fixes: f9f5301e7e2d ("ice: Register auxiliary device to provide RDMA")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
drivers/net/ethernet/intel/ice/ice_idc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_idc.c b/drivers/net/ethernet/intel/ice/ice_idc.c
index 145b27f2a4ce..5db05f54a80c 100644
--- a/drivers/net/ethernet/intel/ice/ice_idc.c
+++ b/drivers/net/ethernet/intel/ice/ice_idc.c
@@ -330,6 +330,7 @@ int ice_plug_aux_dev(struct ice_pf *pf)
return ret;
}
+ iadev = NULL;
ret = auxiliary_device_add(adev);
if (ret) {
auxiliary_device_uninit(adev);
--
2.25.1
next reply other threads:[~2024-08-30 14:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-30 13:33 Ma Ke [this message]
2024-08-30 13:49 ` [Intel-wired-lan] [PATCH] ice: Fix possible double free in error handling path Alexander Lobakin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240830133325.3439293-1-make24@iscas.ac.cn \
--to=make24@iscas.ac.cn \
--cc=anthony.l.nguyen@intel.com \
--cc=davem@davemloft.net \
--cc=david.m.ertman@intel.com \
--cc=edumazet@google.com \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=przemyslaw.kitszel@intel.com \
--cc=shiraz.saleem@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox