* [PATCH net v2] dibs: fix double free of dmb_clientid_arr
2026-07-30 7:56 [PATCH net] " Hidayath Khan
@ 2026-08-06 12:00 ` Hidayath Khan
0 siblings, 0 replies; 4+ messages in thread
From: Hidayath Khan @ 2026-08-06 12:00 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, wintera, alibuda, dust.li, sidraya,
wenjia
Cc: mjambigi, tonylu, guwen, horms, hca, gor, agordeev, borntraeger,
svens, pasic, gbayer, andrew+netdev, netdev, linux-s390,
linux-rdma, linux-kernel
dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
the same pointer again in its err_reg path, so a failing device_add()
or sysfs_create_group() results in a double free.
Drop the kfree() from dibs_lo_dev_probe().
Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
---
v2:
- Fix Fixes: tag (was c3a910f2380f, should be cc21191b584c)
- Remove incorrect Note paragraph copied from a different patch
drivers/dibs/dibs_loopback.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/dibs/dibs_loopback.c b/drivers/dibs/dibs_loopback.c
index fd5caf1e19a8..649e4e375be3 100644
--- a/drivers/dibs/dibs_loopback.c
+++ b/drivers/dibs/dibs_loopback.c
@@ -335,7 +335,6 @@ static int dibs_lo_dev_probe(void)
return 0;
err_reg:
- kfree(dibs->dmb_clientid_arr);
/* pairs with dibs_dev_alloc() */
put_device(&dibs->dev);
kfree(ldev);
base-commit: 92a09f2af870e91efb9471b109db15c2030f90f2
--
2.52.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH net v2] dibs: fix double free of dmb_clientid_arr
@ 2026-08-06 12:04 Hidayath Khan
2026-08-06 23:08 ` Dust Li
2026-08-07 22:50 ` Jakub Kicinski
0 siblings, 2 replies; 4+ messages in thread
From: Hidayath Khan @ 2026-08-06 12:04 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, wintera, alibuda, dust.li, sidraya,
wenjia
Cc: mjambigi, tonylu, guwen, horms, hca, gor, agordeev, borntraeger,
svens, pasic, gbayer, andrew+netdev, netdev, linux-s390,
linux-rdma, linux-kernel
dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
the same pointer again in its err_reg path, so a failing device_add()
or sysfs_create_group() results in a double free.
Drop the kfree() from dibs_lo_dev_probe().
Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
Cc: stable@vger.kernel.org
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
---
v2:
- Fix Fixes: tag (was c3a910f2380f, should be cc21191b584c)
- Remove incorrect Note paragraph copied from a different patch
drivers/dibs/dibs_loopback.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/dibs/dibs_loopback.c b/drivers/dibs/dibs_loopback.c
index fd5caf1e19a8..649e4e375be3 100644
--- a/drivers/dibs/dibs_loopback.c
+++ b/drivers/dibs/dibs_loopback.c
@@ -335,7 +335,6 @@ static int dibs_lo_dev_probe(void)
return 0;
err_reg:
- kfree(dibs->dmb_clientid_arr);
/* pairs with dibs_dev_alloc() */
put_device(&dibs->dev);
kfree(ldev);
base-commit: 92a09f2af870e91efb9471b109db15c2030f90f2
--
2.52.0
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net v2] dibs: fix double free of dmb_clientid_arr
2026-08-06 12:04 [PATCH net v2] dibs: fix double free of dmb_clientid_arr Hidayath Khan
@ 2026-08-06 23:08 ` Dust Li
2026-08-07 22:50 ` Jakub Kicinski
1 sibling, 0 replies; 4+ messages in thread
From: Dust Li @ 2026-08-06 23:08 UTC (permalink / raw)
To: Hidayath Khan, davem, edumazet, kuba, pabeni, wintera, alibuda,
sidraya, wenjia
Cc: mjambigi, tonylu, guwen, horms, hca, gor, agordeev, borntraeger,
svens, pasic, gbayer, andrew+netdev, netdev, linux-s390,
linux-rdma, linux-kernel
On 2026-08-06 14:04:47, Hidayath Khan wrote:
>dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
>paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
>the same pointer again in its err_reg path, so a failing device_add()
>or sysfs_create_group() results in a double free.
>
>Drop the kfree() from dibs_lo_dev_probe().
>
>Fixes: cc21191b584c ("dibs: Move data path to dibs layer")
>Cc: stable@vger.kernel.org
>Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
>Signed-off-by: Hidayath Khan <hidayath@linux.ibm.com>
Reviewed-by: Dust Li <dust.li@linux.alibaba.com>
Best regards,
Dust
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net v2] dibs: fix double free of dmb_clientid_arr
2026-08-06 12:04 [PATCH net v2] dibs: fix double free of dmb_clientid_arr Hidayath Khan
2026-08-06 23:08 ` Dust Li
@ 2026-08-07 22:50 ` Jakub Kicinski
1 sibling, 0 replies; 4+ messages in thread
From: Jakub Kicinski @ 2026-08-07 22:50 UTC (permalink / raw)
To: Hidayath Khan
Cc: davem, edumazet, pabeni, wintera, alibuda, dust.li, sidraya,
wenjia, mjambigi, tonylu, guwen, horms, hca, gor, agordeev,
borntraeger, svens, pasic, gbayer, andrew+netdev, netdev,
linux-s390, linux-rdma, linux-kernel
On Thu, 6 Aug 2026 14:04:47 +0200 Hidayath Khan wrote:
> dibs_dev_add() frees dibs->dmb_clientid_arr on both of its failure
> paths, but does not clear the pointer. dibs_lo_dev_probe() then frees
> the same pointer again in its err_reg path, so a failing device_add()
> or sysfs_create_group() results in a double free.
>
> Drop the kfree() from dibs_lo_dev_probe().
This should be squashed with Alexandra's fix.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-08-07 22:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-06 12:04 [PATCH net v2] dibs: fix double free of dmb_clientid_arr Hidayath Khan
2026-08-06 23:08 ` Dust Li
2026-08-07 22:50 ` Jakub Kicinski
-- strict thread matches above, loose matches on Subject: below --
2026-07-30 7:56 [PATCH net] " Hidayath Khan
2026-08-06 12:00 ` [PATCH net v2] " Hidayath Khan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox