bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
which dereferences bp->fp in a loop bounded by the non-zero
bp->fp_array_size, causing a NULL pointer dereference.

Move the bp->fp_array_size assignment to after bp->fp is set so that
the loop in bnx2x_free_mem_bp() naturally becomes a no-op when bp->fp
is NULL, since bp is zero-initialized and fp_array_size remains 0.

Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan@kylinos.cn
Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>

---
Changes in v2:
- Remove the defensive NULL guard in bnx2x_free_mem_bp() as suggested
  by Vadim Fedorenko, since the assignment-order fix alone is sufficient
  to prevent the NULL pointer dereference (bp is zero-initialized so
  fp_array_size remains 0 when allocation fails).

 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 5b2640bd31c3..926ffe3e2c43 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -4742,13 +4742,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
 
 	/* fp array: RSS plus CNIC related L2 queues */
 	fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp);
-	bp->fp_array_size = fp_array_size;
-	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
+	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
 
-	fp = kzalloc_objs(*fp, bp->fp_array_size);
+	fp = kzalloc_objs(*fp, fp_array_size);
 	if (!fp)
 		goto alloc_err;
 	bp->fp = fp;
+	bp->fp_array_size = fp_array_size;
 	for (i = 0; i < bp->fp_array_size; i++) {
 		fp[i].tpa_info =
 			kzalloc_objs(struct bnx2x_agg_info,
-- 
2.25.1

On Mon, 17 Aug 2026 23:13:26 +0800 Jiangshan Yi wrote:
> Subject: [PATCH v2] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

This patch does not apply to net/main, please rebase and repost.
-- 
pw-bot: cr

> This patch does not apply to net/main, please rebase and repost.
> -- 
> pw-bot: cr


Hi Jakub,

Thanks for the review. While rebasing onto net/main I found this was
already fixed by Abdun Nihaal in commit e354f7d60f14 ("bnx2x: fix null
pointer dereference in bnx2x_free_mem_bp()"), which you merged on
2026-07-20. The fix is functionally identical to this v2 (move
bp->fp_array_size after bp->fp is set, use the local fp_array_size),
so there is nothing left for me to resend.

The duplicate came in because the bug was reported through Sashiko's
automated reporting on 2026-08-15, after Abdun's fix had already
landed. Withdrawing this patch to avoid the duplication -- apologies
for the extra noise.

Best regards,
Jiangshan Yi

On 17/08/2026 16:13, Jiangshan Yi wrote:
> bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
> If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
> which dereferences bp->fp in a loop bounded by the non-zero
> bp->fp_array_size, causing a NULL pointer dereference.
> 
> Move the bp->fp_array_size assignment to after bp->fp is set so that
> the loop in bnx2x_free_mem_bp() naturally becomes a no-op when bp->fp
> is NULL, since bp is zero-initialized and fp_array_size remains 0.
> 
> Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan@kylinos.cn
> Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>

No need for this tag, it's not used for code improvements

> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>

Please, review netdev contribution rules at
https://docs.kernel.org/process/maintainer-netdev.html

Especially patch formatting and 24h cool-down period

> Please, review netdev contribution rules at
> https://docs.kernel.org/process/maintainer-netdev.html
>
> Especially patch formatting and 24h cool-down period

Hi Vadim,

Thank you for the review and the pointers.

I will remove the Suggested-by tag in the next version. I also appreciate
you directing me to the netdev contribution rules — I will carefully read
through https://docs.kernel.org/process/maintainer-netdev.html and make
sure to follow the patch formatting guidelines and respect the 24h
cool-down period for subsequent submissions.

Best regards,
Jiangshan Yi