Re: [PATCH] bnx2x: fix double free in bnx2x_init_firmware() error path
Simon Horman <[email protected]>
| Newsgroups | org.kernel.vger.netdev,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
On Sat, Aug 15, 2026 at 08:21:49PM +0800, Jiangshan Yi wrote:
> bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
> bp->init_ops_offsets in its error path without setting them to NULL.
> The cleanup function bnx2x_release_firmware() frees the same three
> pointers unconditionally, so if init_firmware fails and
> release_firmware is later called (e.g. from __bnx2x_remove or through
> the function state machine), all three are freed a second time.
>
> Set each pointer to NULL after kfree() in the error path so that the
> subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
>
> Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
> Cc: [email protected]
> Signed-off-by: Jiangshan Yi <[email protected]>
Reviewed-by: Simon Horman <[email protected]>