From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id BBD1810775FD for ; Wed, 18 Mar 2026 17:47:45 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id 76DD260BB0; Wed, 18 Mar 2026 17:47:45 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id thAtGVXzoTMD; Wed, 18 Mar 2026 17:47:44 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org E00DF60BA6 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1773856063; bh=5hNKCWgX96sgR6zjiwj8uC7SyiqM+Qdw0bwirpBOYpc=; h=Date:From:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=4Dczsb1Lxke1112DbxoyrhO11KkMF5q9yFmMoe167DKwJXDTRb5PD9j2fIpndwO34 mW41XgL2dIyBx8OAKlw+1DtzGDdaRxsOhu8nt795ReQTtqvrlYz/KMuRZFgpr1nb2A vOdmNdyfO2kAU/+VDCMlakLEYv7lPFZIWzXIV/pZ7vRWh+3A/nY77Tmg4pQAOOY4nQ ABTPHiL2WKd27n1vMKNKg7DfRUZ5EhElw2GWcjJvBq8EI7viWkrds/efhc/EZZldRD DxnVlRlQyN2J1wOx0pYeNtDY2QHJIJO1460NIKAbMKmxfOV5vG1yo6HXYaDU4UxICU 4jC4w89uWCWsQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id E00DF60BA6; Wed, 18 Mar 2026 17:47:43 +0000 (UTC) Received: from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists1.osuosl.org (Postfix) with ESMTP id CEC091AD for ; Wed, 18 Mar 2026 17:47:42 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp1.osuosl.org (Postfix) with ESMTP id C098182278 for ; Wed, 18 Mar 2026 17:47:42 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp1.osuosl.org ([127.0.0.1]) by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id FaFgkQQjqtJf for ; Wed, 18 Mar 2026 17:47:42 +0000 (UTC) X-Greylist: delayed 466 seconds by postgrey-1.37 at util1.osuosl.org; Wed, 18 Mar 2026 17:47:41 UTC DMARC-Filter: OpenDMARC Filter v1.4.2 smtp1.osuosl.org 9EA6581886 DKIM-Filter: OpenDKIM Filter v2.11.0 smtp1.osuosl.org 9EA6581886 Received-SPF: None (mailfrom) identity=mailfrom; client-ip=2001:41b8:202:deb::311:108; helo=stravinsky.debian.org; envelope-from=leitao@debian.org; receiver= Received: from stravinsky.debian.org (stravinsky.debian.org [IPv6:2001:41b8:202:deb::311:108]) by smtp1.osuosl.org (Postfix) with ESMTPS id 9EA6581886 for ; Wed, 18 Mar 2026 17:47:41 +0000 (UTC) Received: from authenticated user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.94.2) (envelope-from ) id 1w2uro-003pAQ-2W; Wed, 18 Mar 2026 17:39:34 +0000 Date: Wed, 18 Mar 2026 10:39:27 -0700 From: Breno Leitao To: Guangshuo Li Cc: Tony Nguyen , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Michal Swiatkowski , Piotr Raczynski , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Message-ID: References: <20260318151028.634828-1-lgs201920130244@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260318151028.634828-1-lgs201920130244@gmail.com> X-Debian-User: leitao X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=5hNKCWgX96sgR6zjiwj8uC7SyiqM+Qdw0bwirpBOYpc=; b=NWUS6RxmSfSu3uQi2YURo3VhoQ DZTzs6tv5kmMS4eLx8ORFN5e9Bt+Z2Ch1+YmhToKDPYxeOwE1W8K7FOFeubzWdWJX9I4NjaRsxC2f gufuanabSwF9JoS9MVXMTFWNpRH2qn7FzgqTQwyReP1Qo7tJCXmdAq4PmNX0U1X49BQ9v+gTdCeyX sjEl94m/iskIweupFLWo1Ntl5bYwwo57fssFaGDVYn9snS2JP2DImZz7vJ8WxkGge+x6ST/poml0r 21KmkL9AJNCoLhYpKMe7mPp8qpJ8frlH2/eD93H+W6mbimkVUTsSzcwPTv09jsISH6ILc9iGmw6r+ T2oqNRPA==; X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dmarc=none (p=none dis=none) header.from=debian.org X-Mailman-Original-Authentication-Results: smtp1.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=debian.org header.i=@debian.org header.a=rsa-sha256 header.s=smtpauto.stravinsky header.b=NWUS6Rxm Subject: Re: [Intel-wired-lan] [PATCH] ice: fix double free in ice_sf_eth_activate() error path X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" On Wed, Mar 18, 2026 at 11:10:28PM +0800, Guangshuo Li wrote: > When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to > aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). > > The device release callback ice_sf_dev_release() frees sf_dev, but > the current error path falls through to sf_dev_free and calls > kfree(sf_dev) again, causing a double free. > > Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but > avoid falling through to sf_dev_free after auxiliary_device_uninit(). > > Fixes: 13acc5c4cdbe ("ice: subfunction activation and base devlink ops") > Cc: stable@vger.kernel.org > Signed-off-by: Guangshuo Li > --- > drivers/net/ethernet/intel/ice/ice_sf_eth.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethernet/intel/ice/ice_sf_eth.c > index 1a2c94375ca7..ec6020338b9f 100644 > --- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c > +++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c > @@ -305,6 +305,7 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port, > > aux_dev_uninit: > auxiliary_device_uninit(&sf_dev->adev); > + goto xa_erase; Do you want to xa_erase? Isn't ice_sf_dev_release() doing the xa_erase already on put_device() path?