* [PATCH v2] net: mana: Fix possible double free in error handling path
@ 2024-06-25 8:38 Ma Ke
2024-06-25 9:13 ` Przemek Kitszel
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Ma Ke @ 2024-06-25 8:38 UTC (permalink / raw)
To: kys, haiyangz, wei.liu, decui, davem, edumazet, kuba, pabeni,
shradhagupta, horms, kotaranov, schakrabarti, erick.archer
Cc: linux-hyperv, netdev, linux-kernel, Ma Ke
When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function adev_release
calls kfree(madev). We shouldn't call kfree(madev) again
in the error handling path. Set 'madev' to NULL.
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
---
Changes in v2:
- streamlined the patch according suggestions;
- revised the description.
---
drivers/net/ethernet/microsoft/mana/mana_en.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index d087cf954f75..608ad31a9702 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -2798,6 +2798,8 @@ static int add_adev(struct gdma_dev *gd)
if (ret)
goto init_fail;
+ /* madev is owned by the auxiliary device */
+ madev = NULL;
ret = auxiliary_device_add(adev);
if (ret)
goto add_fail;
--
2.25.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH v2] net: mana: Fix possible double free in error handling path
2024-06-25 8:38 [PATCH v2] net: mana: Fix possible double free in error handling path Ma Ke
@ 2024-06-25 9:13 ` Przemek Kitszel
2024-06-25 9:38 ` Konstantin Taranov
2024-06-25 9:41 ` Konstantin Taranov
2 siblings, 0 replies; 4+ messages in thread
From: Przemek Kitszel @ 2024-06-25 9:13 UTC (permalink / raw)
To: Ma Ke
Cc: linux-hyperv, netdev, linux-kernel, kys, haiyangz, wei.liu, decui,
davem, edumazet, kuba, pabeni, shradhagupta, horms, kotaranov,
schakrabarti, erick.archer
On 6/25/24 10:38, Ma Ke wrote:
> When auxiliary_device_add() returns error and then calls
> auxiliary_device_uninit(), callback function adev_release
> calls kfree(madev). We shouldn't call kfree(madev) again
> in the error handling path. Set 'madev' to NULL.
>
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
> Changes in v2:
> - streamlined the patch according suggestions;
> - revised the description.
> ---
> drivers/net/ethernet/microsoft/mana/mana_en.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index d087cf954f75..608ad31a9702 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -2798,6 +2798,8 @@ static int add_adev(struct gdma_dev *gd)
> if (ret)
> goto init_fail;
>
> + /* madev is owned by the auxiliary device */
> + madev = NULL;
> ret = auxiliary_device_add(adev);
> if (ret)
> goto add_fail;
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [PATCH v2] net: mana: Fix possible double free in error handling path
2024-06-25 8:38 [PATCH v2] net: mana: Fix possible double free in error handling path Ma Ke
2024-06-25 9:13 ` Przemek Kitszel
@ 2024-06-25 9:38 ` Konstantin Taranov
2024-06-25 9:41 ` Konstantin Taranov
2 siblings, 0 replies; 4+ messages in thread
From: Konstantin Taranov @ 2024-06-25 9:38 UTC (permalink / raw)
To: Ma Ke, KY Srinivasan, Haiyang Zhang, wei.liu@kernel.org,
Dexuan Cui, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com,
shradhagupta@linux.microsoft.com, horms@kernel.org,
schakrabarti@linux.microsoft.com, erick.archer@outlook.com
Cc: linux-hyperv@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
> When auxiliary_device_add() returns error and then calls
> auxiliary_device_uninit(), callback function adev_release calls kfree(madev).
> We shouldn't call kfree(madev) again in the error handling path. Set 'madev'
> to NULL.
>
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
> Changes in v2:
> - streamlined the patch according suggestions;
> - revised the description.
> ---
> drivers/net/ethernet/microsoft/mana/mana_en.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c
> b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index d087cf954f75..608ad31a9702 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -2798,6 +2798,8 @@ static int add_adev(struct gdma_dev *gd)
> if (ret)
> goto init_fail;
>
> + /* madev is owned by the auxiliary device */
> + madev = NULL;
> ret = auxiliary_device_add(adev);
> if (ret)
> goto add_fail;
> --
> 2.25.1
Reviewed-by: Konstantin Taranov <kotaranov@microsoft.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: [PATCH v2] net: mana: Fix possible double free in error handling path
2024-06-25 8:38 [PATCH v2] net: mana: Fix possible double free in error handling path Ma Ke
2024-06-25 9:13 ` Przemek Kitszel
2024-06-25 9:38 ` Konstantin Taranov
@ 2024-06-25 9:41 ` Konstantin Taranov
2 siblings, 0 replies; 4+ messages in thread
From: Konstantin Taranov @ 2024-06-25 9:41 UTC (permalink / raw)
To: Ma Ke, KY Srinivasan, Haiyang Zhang, wei.liu@kernel.org,
Dexuan Cui, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com,
shradhagupta@linux.microsoft.com, horms@kernel.org,
schakrabarti@linux.microsoft.com, erick.archer@outlook.com
Cc: linux-hyperv@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
> When auxiliary_device_add() returns error and then calls
> auxiliary_device_uninit(), callback function adev_release calls kfree(madev).
> We shouldn't call kfree(madev) again in the error handling path. Set 'madev'
> to NULL.
>
> Signed-off-by: Ma Ke <make24@iscas.ac.cn>
> ---
> Changes in v2:
> - streamlined the patch according suggestions;
> - revised the description.
The change is ok, but the commit message is missing a "Fixes" tag/line.
- Konstantin
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-06-25 9:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-06-25 8:38 [PATCH v2] net: mana: Fix possible double free in error handling path Ma Ke
2024-06-25 9:13 ` Przemek Kitszel
2024-06-25 9:38 ` Konstantin Taranov
2024-06-25 9:41 ` Konstantin Taranov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox