From nobody Mon Apr 6 10:43:33 2026 Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9015D34AAE3 for ; Thu, 19 Mar 2026 13:59:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773928767; cv=none; b=G8IEAW66zqD/YjR8WpFVy9Gl1G3dxvjNQ868tOpkWhDmhyrYJQB1eiiVUYnxQtr1ruWC0ky9Os3oXv6OOwYChlgWQ+NWB+7FkF5SmljYf/QDVG1Obo8tA8YxkSY+PYrfLuf3aSAYJ+TGqMCb28WxQEhyavX+mO3E2S8RIvMW+M0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773928767; c=relaxed/simple; bh=rQv2vpKuDgBeqdlFp5TZxrVVv0oRHZC/jYJEf+oSJDk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=q9MTnsomxAR82BgdRsYXi+J+24Cya9OgfkqiP0OJyoF5ukQvQGuKJXNUtleXXeXBns9nGdr2HWblOlrRW540wLjSKyP2lGxjaGR+8LGO46cE2HmbLO3uKzfTv3pO8FJ1KH7vox0CgXAdfqa+h8oHWpowpibREO9pfRpV+lrNJmE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=HKmjUOl6; arc=none smtp.client-ip=209.85.210.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="HKmjUOl6" Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-82a87ef7304so117539b3a.0 for ; Thu, 19 Mar 2026 06:59:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773928766; x=1774533566; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=FM5u2uHSz/VZ9Qz362czB/Bn/2senFQYOZTR+Pv+J5M=; b=HKmjUOl6448b4oWGENYCkOVpT+xqBBuzwUlsdYvVkvSqCb70AievInRTG4GnNDHIbz VCxZRdOkrdHUgbbzr9o443vsvQTSQ2RLRFQR+Xr4sFg+aDDi6l6PKgD3LWKItoR05xTd uCatJu/2CyVJbw5KWbpB25ZJcZl7nHMKeYyX7u87kgrYT3czfAzYYL50WIxzXRTcHXI6 oAltAc+i5/ibkMOzAclcDRz+aX8OlNdGPlYZ+a8DJdrFfoEfVXUgNldOizfYG4J6RJwn 2H+4dQcs+pjYDLlKRSOQoA1vamzjYbvIHlpLcTDUueR7ABBiFK7+DjhFf34rhJx1BzrS Fonw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773928766; x=1774533566; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=FM5u2uHSz/VZ9Qz362czB/Bn/2senFQYOZTR+Pv+J5M=; b=c2JPXYk+H4JLRGc4Hsb4QHQDz9SPtzWw2TzYm1+Fi1tZAbTE5j7+gOOU1sYdbbohOZ kFosalssn/U80cxUgMa82kNXtz0IsNbcVFHnts9tK0X6ZDsU4ZFW/r4M4awJ4h2BJki4 0Is0h5jr1+qHk68w6IBLQS/f9dE44b5llHqD9nWl5xnf+bfUVxVlyruxDPEUQKwKo4C/ O+Xakdwyuv3GozisMKGr1mk5jWPodYCLyq9FGnoF8lAX8ME1/HlzhyhFH3Kk47fFn1tB ccJUJD1npTw/QrO1j2CquVWY7QMEPh7bjiG+ZfvDCdqIDlMZDK12SvZZeH9Qc11i/k8e ulHQ== X-Forwarded-Encrypted: i=1; AJvYcCW5NwyzaN8VqHQQtGC1DJ+bsKLP58aLkfo2lp3Ju3yZx6yJXd6pm+7KB1aV5x8zQMN05LW2i5IcLdUYjug=@vger.kernel.org X-Gm-Message-State: AOJu0YyKDFj4XTmgC6YdmElaBA50T5CbqVALf12fKSlhggHPBXpP/7la ohhq95NtkP6v0fj408dn/TwYjqZXBAZdIFWGIB1M519gaTjK3NBhQT87 X-Gm-Gg: ATEYQzwpdHx0dNiEQDszyhRhRYBEkeuEmYo7pb5uAZTyV3P4gI+9hgkmTgkedQQoxfw vK2YGRdlMXiGiHC5bHEyMSUwAeAh1CcdXcFxSyCgI1jQpMZbAxG3ebYpLeZg1mAxYGZn0jkGjlw ZbOsEJPc52irWL0mn6ws+idt04U1XWH1vibjfR1w5tqCZcfVtRonN1wY43vVPp7AByPBbICuebG z1vcSPwI5M7dUiW34rYRAfczTvEUvCL5WhQE8G3oSiWx3xcHhqT3hCCBybbED/+NI+YugKuYpkH BDvPihFCcQWpCWgtFNQmM+MYSX8YZx1pXbjkyXkGASqTauKsOONREjpjcobva/zZTpa0UzKTb1T g3F9U+lAH3ktdqHZTKtrfrZF7umkREU5RTeQIy3sOaG7V948jl26tr3MItsSBdk/dyqHNVp+c9F v/sN1p7LZFMHzrbJc7APyk X-Received: by 2002:a05:6a00:3319:b0:82a:6255:247b with SMTP id d2e1a72fcca58-82a6ae78489mr6376248b3a.62.1773928765908; Thu, 19 Mar 2026 06:59:25 -0700 (PDT) Received: from lgs.. ([223.80.110.53]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-82a6b56df09sm6237700b3a.21.2026.03.19.06.59.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 19 Mar 2026 06:59:25 -0700 (PDT) From: Guangshuo Li To: Tony Nguyen , Przemek Kitszel , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Michal Swiatkowski , Piotr Raczynski , Simon Horman , intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li , stable@vger.kernel.org, Aleksandr Loktionov Subject: [PATCH v2] ice: fix double free in ice_sf_eth_activate() error path Date: Thu, 19 Mar 2026 21:58:59 +0800 Message-ID: <20260319135859.690041-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" When auxiliary_device_add() fails, ice_sf_eth_activate() jumps to aux_dev_uninit and calls auxiliary_device_uninit(&sf_dev->adev). The device release callback ice_sf_dev_release() frees sf_dev, but the current error path falls through to sf_dev_free and calls kfree(sf_dev) again, causing a double free. Keep kfree(sf_dev) for the auxiliary_device_init() failure path, but avoid falling through to sf_dev_free after auxiliary_device_uninit(). Fixes: 13acc5c4cdbe ("ice: subfunction activation and base devlink ops") Cc: stable@vger.kernel.org Reviewed-by: Aleksandr Loktionov Signed-off-by: Guangshuo Li Reviewed-by: Simon Horman --- v2: - replace goto xa_erase with return err after auxiliary_device_uninit() - avoid xa_erase() in the auxiliary_device_uninit() path since it is alre= ady done in ice_sf_dev_release() drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethe= rnet/intel/ice/ice_sf_eth.c index 1a2c94375ca7..f7266d036815 100644 --- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c +++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c @@ -305,6 +305,8 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port, =20 aux_dev_uninit: auxiliary_device_uninit(&sf_dev->adev); + return err; + sf_dev_free: kfree(sf_dev); xa_erase: --=20 2.43.0