When idtab allocation fails, net is not registered with rio_add_net()
yet, so kfree(net) is sufficient to release the memory.
Set mport->net to NULL to avoid dangling pointer.

Fixes: e6b585ca6e81 ("rapidio: move net allocation into core code")
Cc: stable@vger.kernel.org
Signed-off-by: Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
---
Changes in v2:
- Set mport->net to NULL. Thanks, Andrew!
---
 drivers/rapidio/rio-scan.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/rapidio/rio-scan.c b/drivers/rapidio/rio-scan.c
index c12941f71e2c..dcd6619a4b02 100644
--- a/drivers/rapidio/rio-scan.c
+++ b/drivers/rapidio/rio-scan.c
@@ -854,7 +854,8 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
 
 		if (idtab == NULL) {
 			pr_err("RIO: failed to allocate destID table\n");
-			rio_free_net(net);
+			kfree(net);
+			mport->net = NULL;
 			net = NULL;
 		} else {
 			net->enum_data = idtab;
-- 
2.25.1

On Wed, 21 Jan 2026 09:35:08 +0800 Haoxiang Li <lihaoxiang@isrc.iscas.ac.cn> wrote:

> When idtab allocation fails, net is not registered with rio_add_net()
> yet, so kfree(net) is sufficient to release the memory.
> Set mport->net to NULL to avoid dangling pointer.
> 
> ...
>
> --- a/drivers/rapidio/rio-scan.c
> +++ b/drivers/rapidio/rio-scan.c
> @@ -854,7 +854,8 @@ static struct rio_net *rio_scan_alloc_net(struct rio_mport *mport,
>  
>  		if (idtab == NULL) {
>  			pr_err("RIO: failed to allocate destID table\n");
> -			rio_free_net(net);
> +			kfree(net);
> +			mport->net = NULL;

Sure.  Might not have any effect, but it's defensive.

>  			net = NULL;
>  		} else {
>  			net->enum_data = idtab;

I'll add this to the 6.20(?)-rcX queue soon, unless someone stops me.