From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 6AE2AF31E21 for ; Thu, 9 Apr 2026 15:11:32 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 0DAE2608C0; Thu, 9 Apr 2026 15:11:32 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Jy4lyNysns67; Thu, 9 Apr 2026 15:11:30 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 2BB5B6083A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1775747490; bh=Fxy9eCg2BDClTRLYbOVTj4F8EbvnnhW1/tW77Z1U57c=; h=From:To:Cc:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:From; b=mBscFD2KV+jBeOkTwEi6BseZMiUTTeD47mz/nHQwOmarMxFPIRX3bb/WVS+Wd7EES naS+2DrK/JbEJHjOAVx7O+d9dVeXAwztfbEexbvpkD3hKzci/5mJcCoNFKXbrt/Sxb 2/ZvdD5xhGvHexArseAt8NVKGqvrLOvCRiKpFyV2jX4cBbpCDaAHmi4P7MUuMY3GS2 hdCae/oCHogrcqETgtv2r/EHpSnnqs89AImY1McfQ4PBveJ1gIxKIJaA12Esq3dBGP 1HwrGg9VuMhMZ/vPra0dlxpAfuRg1MZbwtSnsffLol6Fmkox/ORm87tGFha14Py1/H 4y9lkUwJcoYdQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 2BB5B6083A; Thu, 9 Apr 2026 15:11:30 +0000 (UTC) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id EA9561D6 for ; Thu, 9 Apr 2026 15:11:28 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id DBF6482105 for ; Thu, 9 Apr 2026 15:11:28 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id Z85lCwoAZ-Hm for ; Thu, 9 Apr 2026 15:11:28 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=172.105.4.254; helo=tor.source.kernel.org; envelope-from=gregkh@linuxfoundation.org; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp1.osuosl.org 0087B82060 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 0087B82060 Received: from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254]) by smtp1.osuosl.org (Postfix) with ESMTPS id 0087B82060 for ; Thu, 9 Apr 2026 15:11:27 +0000 (UTC) Received: from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58]) by tor.source.kernel.org (Postfix) with ESMTP id 02E5960103; Thu, 9 Apr 2026 15:11:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35BDEC4CEF7; Thu, 9 Apr 2026 15:11:25 +0000 (UTC) From: Greg Kroah-Hartman To: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Tony Nguyen , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Piotr Raczynski , Jiri Pirko , Simon Horman , Michal Swiatkowski , stable Date: Thu, 9 Apr 2026 17:11:20 +0200 Message-ID: <2026040919-junior-glue-10d0@gregkh> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1839; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=ld3ezbMvVsNELdIRgsT43RqN5vGdmDKDso8u1ZYLZMA=; b=owGbwMvMwCRo6H6F97bub03G02pJDJnXD05fFnv6UNmHJrlpXC+r/93mOC14dpthbqKszUIHu cVp3GbeHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRnkkM86O+Mf12sp4Z6hch cP6zTt0xxacTghkWLLw+v0Z2V8rEAoPLYR3rgqxl5uswAAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775747485; bh=ld3ezbMvVsNELdIRgsT43RqN5vGdmDKDso8u1ZYLZMA=; h=From:To:Cc:Subject:Date:From; b=P9GyPh1RHg21nZpKuzGezt9h1an5z7/4COuTMcsxGjmPs58NwXcbZkSyaeJE9mwU/ 8Ce9H6ftVM1KJNnMgzs9ZvlLrwxka9Z7m3oECpk0GY+xuAxylFEuKy1DCBPa+RD3PV lIuZ1EKyRHq0+MiGcCWhKx87i2Fja0CPxlCDe24w= X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dmarc=pass (p=none dis=none) header.from=linuxfoundation.org X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=P9GyPh1R Subject: [Intel-wired-lan] [PATCH net] ice: fix double free in ice_sf_eth_activate() error path X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" When auxiliary_device_add() fails, the aux_dev_uninit label calls auxiliary_device_uninit() and falls through to sf_dev_free and xa_erase. The uninit invokes ice_sf_dev_release(), which already frees sf_dev via kfree() and erases the entry from ice_sf_aux_id. The fall-through then double-frees sf_dev and double-erases the id. This is reachable from userspace via the devlink port function state-set netlink command. Fix this by returning right after uninit because the release callback handles all cleanup correctly. Cc: Tony Nguyen Cc: Przemek Kitszel Cc: Andrew Lunn Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Piotr Raczynski Cc: Jiri Pirko Cc: Simon Horman Cc: Michal Swiatkowski Fixes: 177ef7f1e2a0 ("ice: base subfunction aux driver") Cc: stable Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethernet/intel/ice/ice_sf_eth.c index 2cf04bc6edce..6bc8aa896762 100644 --- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c +++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c @@ -304,7 +304,9 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port, return 0; aux_dev_uninit: + /* ice_sf_dev_release() frees sf_dev and erases the xa entry */ auxiliary_device_uninit(&sf_dev->adev); + return err; sf_dev_free: kfree(sf_dev); xa_erase: -- 2.53.0