Re: [PATCH net v2 1/2] ionic: fix port_info use-after-free on firmware recovery

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 16/10/2026 00:03, Eric Joyner wrote:
> From: "Nikhil P. Rao" <nikhil.rao@amd.com>
> 
> ionic_port_init() allocates port_info when the pointer is NULL, but its
> error path frees it without checking whether this call allocated it.
> Before commit ddc5911b9bd2 ("ionic: call ionic_port_init after
> fw-upgrade") the function returned early when the buffer already
> existed, so the two were symmetric.
> 
> Since then a failed PORT_INIT on either recovery path - fw_up or
> reset_done - frees a buffer an earlier init owns, while the netdev is
> registered and the ethtool ops are reading it.
> 
> Free only what this call allocated.
> 
> Fixes: ddc5911b9bd2 ("ionic: call ionic_port_init after fw-upgrade")
> Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
> Signed-off-by: Eric Joyner <eric.joyner@amd.com>
> ---
>   drivers/net/ethernet/pensando/ionic/ionic_main.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c
> index 10501be9ef95..38b47b959a11 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_main.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c
> @@ -722,6 +722,7 @@ int ionic_port_init(struct ionic *ionic)
>   {
>   	struct ionic_identity *ident = &ionic->ident;
>   	struct ionic_dev *idev = &ionic->idev;
> +	bool allocated = false;
>   	size_t sz;
>   	int err;
>   
> @@ -733,6 +734,8 @@ int ionic_port_init(struct ionic *ionic)
>   						     GFP_KERNEL);
>   		if (!idev->port_info)
>   			return -ENOMEM;
> +
> +		allocated = true;
>   	}
>   
>   	/* If the driver knows about more "extra stats" than the firmware,
> @@ -757,10 +760,12 @@ int ionic_port_init(struct ionic *ionic)
>   	mutex_unlock(&ionic->dev_cmd_lock);
>   	if (err) {
>   		dev_err(ionic->dev, "Failed to init port\n");
> -		dma_free_coherent(ionic->dev, idev->port_info_sz,
> -				  idev->port_info, idev->port_info_pa);
> -		idev->port_info = NULL;
> -		idev->port_info_pa = 0;
> +		if (allocated) {
> +			dma_free_coherent(ionic->dev, idev->port_info_sz,
> +					  idev->port_info, idev->port_info_pa);
> +			idev->port_info = NULL;
> +			idev->port_info_pa = 0;
> +		}
>   	}
>   
>   	return err;
> 
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>