[PATCH net v3 1/3] net: fealnx: fix teardown order in remove

[PATCH net v3 1/3] net: fealnx: fix teardown order in remove

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

fealnx_remove_one() frees the DMA rings before unregistering the
netdev, while the interface may still be up, which leaves a
window where freed memory can be accessed.

Call unregister_netdev() first so dev_close() completes before
the rings are freed.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index bdc38aac5850..68194c9ef332 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -682,11 +682,11 @@ static void fealnx_remove_one(struct pci_dev *pdev)
 	if (dev) {
 		struct netdev_private *np = netdev_priv(dev);
 
+		unregister_netdev(dev);
 		dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
 				  np->tx_ring_dma);
 		dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
 				  np->rx_ring_dma);
-		unregister_netdev(dev);
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
-- 
2.53.0

Re: [PATCH net v3 1/3] net: fealnx: fix teardown order in remove

[Andrew Lunn]

On Mon, Oct 19, 2026 at 01:42:49PM +0000, Жамбакиев Радий Рикардинович wrote:
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> fealnx_remove_one() frees the DMA rings before unregistering the
> netdev, while the interface may still be up, which leaves a
> window where freed memory can be accessed.
> 
> Call unregister_netdev() first so dev_close() completes before
> the rings are freed.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Seems unlikely this bothers anybody if you are referencing this
commit. Please submit to net-next, in three weeks time when the merge
window closes.

	Andrew

[PATCH net v3 2/3] net: fealnx: disable the PCI device on remove and probe failure

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

pci_enable_device() is called in probe, but the device is never
disabled on probe failure or remove. Device remains enabled and
bus mastering stays active.

Add pci_disable_device() to the probe error unwind and to
fealnx_remove_one(), after all other resources have been released.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index 68194c9ef332..b5e96c7037f3 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -502,12 +502,13 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	if (len < MIN_REGION_SIZE) {
 		dev_err(&pdev->dev,
 			   "region size %ld too small, aborting\n", len);
-		return -ENODEV;
+		err = -ENODEV;
+		goto err_out_disable;
 	}
 
-	i = pci_request_regions(pdev, boardname);
-	if (i)
-		return i;
+	err = pci_request_regions(pdev, boardname);
+	if (err)
+		goto err_out_disable;
 
 	irq = pdev->irq;
 
@@ -671,6 +672,8 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	pci_iounmap(pdev, ioaddr);
 err_out_res:
 	pci_release_regions(pdev);
+err_out_disable:
+	pci_disable_device(pdev);
 	return err;
 }
 
@@ -690,6 +693,7 @@ static void fealnx_remove_one(struct pci_dev *pdev)
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
+		pci_disable_device(pdev);
 	} else
 		printk(KERN_ERR "fealnx: remove for unknown device\n");
 }
-- 
2.53.0

RE: [PATCH net v3 2/3] net: fealnx: disable the PCI device on remove and probe failure

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Жамбакиев Радий Рикардинович <r.zhambakiev@prosoftsystems.ru>
> Sent: Monday, October 19, 2026 3:43 PM
> To: Andrew Lunn <andrew+netdev@lunn.ch>
> Cc: Жамбакиев Радий Рикардинович <r.zhambakiev@prosoftsystems.ru>; David
> S. Miller <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>;
> Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>;
> Michael Grzeschik <mgr@kernel.org>; Jijie Shao <shaojijie@huawei.com>;
> Loktionov, Aleksandr <aleksandr.loktionov@intel.com>; Denis Benato
> <benato.denis96@gmail.com>; Uwe Kleine-König (The Capable Hub)
> <u.kleine-koenig@baylibre.com>; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; lvc-project@linuxtesting.org;
> stable@vger.kernel.org
> Subject: [PATCH net v3 2/3] net: fealnx: disable the PCI device on
> remove and probe failure
> 
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> pci_enable_device() is called in probe, but the device is never disabled
> on probe failure or remove. Device remains enabled and bus mastering
> stays active.
> 
> Add pci_disable_device() to the probe error unwind and to
> fealnx_remove_one(), after all other resources have been released.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> ---
>  drivers/net/ethernet/fealnx.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/fealnx.c
> b/drivers/net/ethernet/fealnx.c index 68194c9ef332..b5e96c7037f3 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -502,12 +502,13 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	if (len < MIN_REGION_SIZE) {
>  		dev_err(&pdev->dev,
>  			   "region size %ld too small, aborting\n", len);
> -		return -ENODEV;
> +		err = -ENODEV;
> +		goto err_out_disable;
>  	}
> 
> -	i = pci_request_regions(pdev, boardname);
> -	if (i)
> -		return i;
> +	err = pci_request_regions(pdev, boardname);
> +	if (err)
> +		goto err_out_disable;
> 
>  	irq = pdev->irq;
> 
> @@ -671,6 +672,8 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	pci_iounmap(pdev, ioaddr);
>  err_out_res:
>  	pci_release_regions(pdev);
> +err_out_disable:
> +	pci_disable_device(pdev);
>  	return err;
>  }
> 
> @@ -690,6 +693,7 @@ static void fealnx_remove_one(struct pci_dev *pdev)
>  		pci_iounmap(pdev, np->mem);
>  		free_netdev(dev);
>  		pci_release_regions(pdev);
> +		pci_disable_device(pdev);
>  	} else
>  		printk(KERN_ERR "fealnx: remove for unknown device\n");  }
> --
> 2.53.0

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

[PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

card_idx is a static counter that is incremented on every
probe. It can overflow and wrap to a negative value, which
then indexes options[] and full_duplex[] out of bounds.
Large values also no longer fit in the 12-byte boardname[]
buffer.

Bound card_idx to 99999, the largest value that still fits
into boardname, and fail the probe for any card beyond that.

fealnx is an old driver that cannot be tested properly on
real hardware, so a minimal best-effort guard was chosen
over a larger rework.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index b5e96c7037f3..d5931c0314fc 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -41,6 +41,7 @@ static int rx_copybreak;
 /* interoperability.                                            */
 /* The media type is usually passed in 'options[]'.             */
 #define MAX_UNITS 8		/* More are supported, limit only on options */
+#define MAX_CARD_IDX		99999
 static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 
@@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	int bar = 1;
 #endif
 
+	if (card_idx >= MAX_CARD_IDX) {
+		dev_err(&pdev->dev, "card_idx is too big %d, aborting", card_idx);
+		return -ENODEV;
+	}
 	card_idx++;
 	sprintf(boardname, "fealnx%d", card_idx);
 
-- 
2.53.0

Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Fedor Pchelkin]

On Mon, 19. Oct 13:43, Жамбакиев Радий Рикардинович wrote:
> diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
> index b5e96c7037f3..d5931c0314fc 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -41,6 +41,7 @@ static int rx_copybreak;
>  /* interoperability.                                            */
>  /* The media type is usually passed in 'options[]'.             */
>  #define MAX_UNITS 8		/* More are supported, limit only on options */
> +#define MAX_CARD_IDX		99999
>  static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
>  static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
>  
> @@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	int bar = 1;
>  #endif
>  
> +	if (card_idx >= MAX_CARD_IDX) {
> +		dev_err(&pdev->dev, "card_idx is too big %d, aborting", card_idx);
> +		return -ENODEV;
> +	}
>  	card_idx++;
>  	sprintf(boardname, "fealnx%d", card_idx);

There is a compiler warning with a W=1 build the testing bots will
soon complain about:

drivers/net/ethernet/fealnx.c:498:35: warning: '%d' directive writing between 1 and 11 bytes into a region of size 6 [-Wformat-overflow=]
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |                                   ^~
drivers/net/ethernet/fealnx.c:498:28: note: directive argument in the range [-2147483647, 99999]
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |                            ^~~~~~~~~~
drivers/net/ethernet/fealnx.c:498:9: note: 'sprintf' output between 8 and 18 bytes into a destination of size 12
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Andrew Lunn]

On Mon, Oct 19, 2026 at 01:43:03PM +0000, Жамбакиев Радий Рикардинович wrote:
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> card_idx is a static counter that is incremented on every
> probe. It can overflow and wrap to a negative value, which
> then indexes options[] and full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[]
> buffer.
> 
> Bound card_idx to 99999, the largest value that still fits
> into boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on
> real hardware, so a minimal best-effort guard was chosen
> over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

Please drop the Fixes: when you repost to net-next. This is one of
those theoretical fixes which never happens and nobody cares about, so
there is no need to backport it to stable.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew

RE: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Жамбакиев Радий Рикардинович <r.zhambakiev@prosoftsystems.ru>
> Sent: Monday, October 19, 2026 3:43 PM
> To: Andrew Lunn <andrew+netdev@lunn.ch>
> Cc: Жамбакиев Радий Рикардинович <r.zhambakiev@prosoftsystems.ru>; David
> S. Miller <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>;
> Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>;
> Michael Grzeschik <mgr@kernel.org>; Jijie Shao <shaojijie@huawei.com>;
> Loktionov, Aleksandr <aleksandr.loktionov@intel.com>; Denis Benato
> <benato.denis96@gmail.com>; Uwe Kleine-König (The Capable Hub)
> <u.kleine-koenig@baylibre.com>; netdev@vger.kernel.org; linux-
> kernel@vger.kernel.org; lvc-project@linuxtesting.org;
> stable@vger.kernel.org
> Subject: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-
> of-bounds access
> 
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> card_idx is a static counter that is incremented on every probe. It can
> overflow and wrap to a negative value, which then indexes options[] and
> full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[] buffer.
> 
> Bound card_idx to 99999, the largest value that still fits into
> boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on real hardware,
> so a minimal best-effort guard was chosen over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> ---
>  drivers/net/ethernet/fealnx.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/net/ethernet/fealnx.c
> b/drivers/net/ethernet/fealnx.c index b5e96c7037f3..d5931c0314fc 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -41,6 +41,7 @@ static int rx_copybreak;
>  /* interoperability.                                            */
>  /* The media type is usually passed in 'options[]'.             */
>  #define MAX_UNITS 8		/* More are supported, limit only on options
> */
> +#define MAX_CARD_IDX		99999
>  static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
> 
> @@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	int bar = 1;
>  #endif
> 
> +	if (card_idx >= MAX_CARD_IDX) {
> +		dev_err(&pdev->dev, "card_idx is too big %d, aborting",
> card_idx);
> +		return -ENODEV;
> +	}
>  	card_idx++;
card_idx can reach 100000 is it ok? 

>  	sprintf(boardname, "fealnx%d", card_idx);
> 
> --
> 2.53.0

Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Andrew Lunn]

> > +	if (card_idx >= MAX_CARD_IDX) {
> > +		dev_err(&pdev->dev, "card_idx is too big %d, aborting",
> > card_idx);
> > +		return -ENODEV;
> > +	}
> >  	card_idx++;
> card_idx can reach 100000 is it ok? 

It is one of those stupid LLM issues which never happens, but
$DEVELOPER wants to fix it anyway.

If you unbind and bind the device lots, you can eventually get
card_idx to overflow. Assuming card_idx is a 32 bit int, and it takes
10ms to unbind/bind, you could make it overflow in about 18 months.

100,000 iterations makes it around 16 hours, which is feasible, so i
hope the submitted has tested it. But probably not, it is just
pointless LLM churn wasting all our time.

     Andrew