From nobody Mon Apr 6 17:26:37 2026 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5F533DFC86 for ; Wed, 18 Mar 2026 15:10:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773846651; cv=none; b=bD/7OrkZ/HRJHfSKA++ocZnQp41Oa8gIu6/A8KNm/LMyG/NCjmQx/z0uD3Y/+OVoL4ymRrp+d7Oah1CnIwCs+14DOQiZdzP5wXBYlDLscRDXikKNH+i5y7B0iAyIvq3dzOgpI14l1kbJS1/zCLjXTs+lu6iZ5clWZAcutVWJuK4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773846651; c=relaxed/simple; bh=QG2BtrENZ1xORdkNqsDB6dpPSvjNG1S30qT6a0FlLMg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kM1WTGCf3UDAIGoVMJziKwYCJI5ReIYoq3XDm33fBwMUgtKWHxaoVfWIYiMMr/4L1px+hrTAlRlwLdfG7YD3KHAZ9mJvstkCCsraG3KOwjPLiDHCL2AojEl8AZaRIONja1uIIs0kIvL0/5pP3LtOZIx4ACoykScmZf3O8BRJlzI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VOJhrXtC; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VOJhrXtC" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-829865a8471so20445b3a.3 for ; Wed, 18 Mar 2026 08:10:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773846649; x=1774451449; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=l3RkPnsLYSDbKLEv/BKhHIWIll2IYC1YAGuzM3YXuSw=; b=VOJhrXtCM03xnJ2IfuxoTlqAVuzKpLmEjqqPKPINQ9M5MHaasEIcFOfwmaSugv3Bsf rNMMwBD9OnQDskrbV/UAbmoIzp+vOgeslUbux4sru4BG7+fVjljuNix7JJO5p8Y9uZS6 /WfXLpKcSYfjpeFT8N0e+wmWTSbrGvMAMbQMr84yS/7OGEaVDpRlox7WcDyd0QRwbeZb JQIZpog8kjLljS/1XfCfZ4H24IRDLdLKtzmKcCgY7pYjyots+IQNDOzjn0O4YD4eNpNs QYMzrisFI+d4gWgpp50CPHk0USXPvAOkySP0pBZvbEZeb54PWpMfRnmg8lgXZOIUXn1O 0B7Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773846649; x=1774451449; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=l3RkPnsLYSDbKLEv/BKhHIWIll2IYC1YAGuzM3YXuSw=; b=g1ZhVOlazO929heXQx9Un1VhHpoXqDhE/k5xPlJNj8bh5DN28dbAuserfa0V2BpBCW LsB5GT2L9F1CvbVyVbWKdWULw4/VuSQ02PnU95uhIwEIEFmuTI/Z1VsVEj1vSYUitEjC kZggfCIhVBk8l5khJi6QXh4thm07+NphAt+/aot0MDUelDUIMzHky9phKBe0AECqIBhC DIFi/6JpoCpaKYkzrvCrMBGku/YabfSDg8ugWHL6Wwr/JyBZRY1swCr8mQF3tnU8PWs7 +515y6ZeMEuSU/ZZZV2FqAweT+oWL4F1nX1UySDwbru9OArnYHaBqv44jSatzOC0a3zK kjjA== X-Forwarded-Encrypted: i=1; AJvYcCXZCVRJpX9qDgmym0mcLemJckCNa7GAk4TahMyr7IC5Qlcm4dudCcuj98t0ViDOy61HvWd/XKRvtZGQERc=@vger.kernel.org X-Gm-Message-State: AOJu0YytB6jYPnZBkHDiHmTfxo0QxsXnmtbX29dxiUgCQkK6uMnxa4/s Y14p/Xg7erQP35rdZqgZ9m3xrKlGhwikJUQp9sqIhnt6TSAZXUfF/HIH X-Gm-Gg: ATEYQzxjYZK8G4VDuGB1khnlhnpmSxUfdA05g3GpE27HOaJn5++0CYRs+v3DGAqqtxu Dou2LG2oqcE+aqWO+M0o3xCzX8Y2TU3BO5ypxDZIOI8mv73VmHaVcgbjfbtXbwmVtKgDpGz0jah aXI+u7w+UwrHUbKP/tlySM8M7YBKXtPMwBflFQqtO37TkOjkMqpkPfhbbNYYztTfsp3TLz9/1w0 g4b1TR1ZoytK4LLPLO6B+JeZYpuTyG5qaoRTlD1dSot53jCCLfHcL6DWZ24TzVWaPWq/UMTZBe7 s/TDeGJPkiODAe/63s1bJvHPjyqwXtm44sY/ZTXmKnQLxP3pxOhswZRMfbntrxHhzNp5YSAboQn 8/DisPzFI09QUYT4lG1foXb1y+CiObDoCIn8SxDWLXAZN//UEQdqDePVMfuNi50dZb7J942WfD3 5n7AvGCVPtUbk5a4FdB+hF X-Received: by 2002:a05:6a00:3698:b0:824:9848:b020 with SMTP id d2e1a72fcca58-82a6b26e7a3mr3339406b3a.52.1773846649082; Wed, 18 Mar 2026 08:10:49 -0700 (PDT) Received: from lgs.. ([223.80.110.53]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82a6bef2fdbsm3090533b3a.56.2026.03.18.08.10.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Mar 2026 08:10:48 -0700 (PDT) From: Guangshuo Li To: Tony Nguyen , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Simon Horman , Michal Swiatkowski , Piotr Raczynski , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org Subject: [PATCH] ice: fix double free in ice_sf_eth_activate() error path Date: Wed, 18 Mar 2026 23:10:28 +0800 Message-ID: <20260318151028.634828-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev, but the current error path falls through to sf_dev_free and calls kfree(sf_dev) again, causing a double free. Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but avoid falling through to sf_dev_free after auxiliary_device_uninit(). Fixes: 13acc5c4cdbe ("ice: subfunction activation and base devlink ops") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Reviewed-by: Aleksandr Loktionov --- drivers/net/ethernet/intel/ice/ice_sf_eth.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethe= rnet/intel/ice/ice_sf_eth.c index 1a2c94375ca7..ec6020338b9f 100644 --- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c +++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c @@ -305,6 +305,7 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port, =20 aux_dev_uninit: auxiliary_device_uninit(&sf_dev->adev); + goto xa_erase; sf_dev_free: kfree(sf_dev); xa_erase: --=20 2.43.0