In of_dpa_cmd_add_l2_flood(), we allocate memory for the
group->l2_flood.group_ids array, freeing any previous array.
However, in the error-exit path we free the group_ids memory but do
not clear the pointer to NULL.  This means that if the guest causes
us to take the error-exit path and then later call the function
again, we will try again to free the memory we already freed.

Fix this by clearing the group_ids pointer in the error exit
path, so we maintain the invariant of "either it points at
allocated memory, or it is NULL" (both being valid to g_free()).

Cc: qemu-stable@nongnu.org
Fixes: dc488f88806 ("rocker: add new rocker switch device")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3253
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/rocker/rocker_of_dpa.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
index 814f19afc5..3190a0e75c 100644
--- a/hw/net/rocker/rocker_of_dpa.c
+++ b/hw/net/rocker/rocker_of_dpa.c
@@ -2059,6 +2059,7 @@ static int of_dpa_cmd_add_l2_flood(OfDpa *of_dpa, OfDpaGroup *group,
 err_out:
     group->l2_flood.group_count = 0;
     g_free(group->l2_flood.group_ids);
+    group->l2_flood.group_ids = NULL;
     g_free(tlvs);
 
     return err;
-- 
2.43.0

On 24/3/26 20:35, Peter Maydell wrote:
> In of_dpa_cmd_add_l2_flood(), we allocate memory for the
> group->l2_flood.group_ids array, freeing any previous array.
> However, in the error-exit path we free the group_ids memory but do
> not clear the pointer to NULL.  This means that if the guest causes
> us to take the error-exit path and then later call the function
> again, we will try again to free the memory we already freed.
> 
> Fix this by clearing the group_ids pointer in the error exit
> path, so we maintain the invariant of "either it points at
> allocated memory, or it is NULL" (both being valid to g_free()).
> 
> Cc: qemu-stable@nongnu.org
> Fixes: dc488f88806 ("rocker: add new rocker switch device")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3253
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
>   hw/net/rocker/rocker_of_dpa.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

On Wed, 25 Mar 2026 at 10:00, Philippe Mathieu-Daudé <philmd@linaro.org> wrote:
>
> On 24/3/26 20:35, Peter Maydell wrote:
> > In of_dpa_cmd_add_l2_flood(), we allocate memory for the
> > group->l2_flood.group_ids array, freeing any previous array.
> > However, in the error-exit path we free the group_ids memory but do
> > not clear the pointer to NULL.  This means that if the guest causes
> > us to take the error-exit path and then later call the function
> > again, we will try again to free the memory we already freed.
> >
> > Fix this by clearing the group_ids pointer in the error exit
> > path, so we maintain the invariant of "either it points at
> > allocated memory, or it is NULL" (both being valid to g_free()).
> >
> > Cc: qemu-stable@nongnu.org
> > Fixes: dc488f88806 ("rocker: add new rocker switch device")
> > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3253
> > Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> > ---
> >   hw/net/rocker/rocker_of_dpa.c | 1 +
> >   1 file changed, 1 insertion(+)
>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>

Thanks; I'll take this via target-arm.next unless anybody
objects, as I'm planning a pullreq for the next rc anyway.

-- PMM