{"id":2221500,"url":"http://patchwork.ozlabs.org/api/1.2/patches/2221500/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/2026040919-junior-glue-10d0@gregkh/","project":{"id":46,"url":"http://patchwork.ozlabs.org/api/1.2/projects/46/?format=json","name":"Intel Wired Ethernet development","link_name":"intel-wired-lan","list_id":"intel-wired-lan.osuosl.org","list_email":"intel-wired-lan@osuosl.org","web_url":"","scm_url":"","webscm_url":"","list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<2026040919-junior-glue-10d0@gregkh>","list_archive_url":null,"date":"2026-04-09T15:11:20","name":"[net] ice: fix double free in ice_sf_eth_activate() error path","commit_ref":null,"pull_url":null,"state":"new","archived":false,"hash":"1f28857a1cc44b4d7aaacc7818dc92ff2faa316f","submitter":{"id":11800,"url":"http://patchwork.ozlabs.org/api/1.2/people/11800/?format=json","name":"Greg Kroah-Hartman","email":"gregkh@linuxfoundation.org"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/intel-wired-lan/patch/2026040919-junior-glue-10d0@gregkh/mbox/","series":[{"id":499312,"url":"http://patchwork.ozlabs.org/api/1.2/series/499312/?format=json","web_url":"http://patchwork.ozlabs.org/project/intel-wired-lan/list/?series=499312","date":"2026-04-09T15:11:20","name":"[net] ice: fix double free in ice_sf_eth_activate() error path","version":1,"mbox":"http://patchwork.ozlabs.org/series/499312/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/2221500/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2221500/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":["incoming@patchwork.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Delivered-To":["patchwork-incoming@legolas.ozlabs.org","intel-wired-lan@lists.osuosl.org"],"Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=osuosl.org header.i=@osuosl.org header.a=rsa-sha256\n header.s=default header.b=mBscFD2K;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org\n (client-ip=2605:bc80:3010::136; helo=smtp3.osuosl.org;\n envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver=patchwork.ozlabs.org)"],"Received":["from smtp3.osuosl.org (smtp3.osuosl.org [IPv6:2605:bc80:3010::136])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fs3LG44fjz1yD3\n\tfor ; Fri, 10 Apr 2026 01:11:33 +1000 (AEST)","from localhost (localhost [127.0.0.1])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 0DAE2608C0;\n\tThu, 9 Apr 2026 15:11:32 +0000 (UTC)","from smtp3.osuosl.org ([127.0.0.1])\n by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id Jy4lyNysns67; Thu, 9 Apr 2026 15:11:30 +0000 (UTC)","from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142])\n\tby smtp3.osuosl.org (Postfix) with ESMTP id 2BB5B6083A;\n\tThu, 9 Apr 2026 15:11:30 +0000 (UTC)","from smtp1.osuosl.org (smtp1.osuosl.org [140.211.166.138])\n by lists1.osuosl.org (Postfix) with ESMTP id EA9561D6\n for ; Thu, 9 Apr 2026 15:11:28 +0000 (UTC)","from localhost (localhost [127.0.0.1])\n by smtp1.osuosl.org (Postfix) with ESMTP id DBF6482105\n for ; Thu, 9 Apr 2026 15:11:28 +0000 (UTC)","from smtp1.osuosl.org ([127.0.0.1])\n by localhost (smtp1.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP\n id Z85lCwoAZ-Hm for ;\n Thu, 9 Apr 2026 15:11:28 +0000 (UTC)","from tor.source.kernel.org (tor.source.kernel.org [172.105.4.254])\n by smtp1.osuosl.org (Postfix) with ESMTPS id 0087B82060\n for ; Thu, 9 Apr 2026 15:11:27 +0000 (UTC)","from smtp.kernel.org (transwarp.subspace.kernel.org [100.75.92.58])\n by tor.source.kernel.org (Postfix) with ESMTP id 02E5960103;\n Thu, 9 Apr 2026 15:11:26 +0000 (UTC)","by smtp.kernel.org (Postfix) with ESMTPSA id 35BDEC4CEF7;\n Thu, 9 Apr 2026 15:11:25 +0000 (UTC)"],"X-Virus-Scanned":["amavis at osuosl.org","amavis at osuosl.org"],"X-Comment":"SPF check N/A for local connections - client-ip=140.211.166.142;\n helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org;\n receiver= ","DKIM-Filter":["OpenDKIM Filter v2.11.0 smtp3.osuosl.org 2BB5B6083A","OpenDKIM Filter v2.11.0 smtp1.osuosl.org 0087B82060"],"DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org;\n\ts=default; t=1775747490;\n\tbh=Fxy9eCg2BDClTRLYbOVTj4F8EbvnnhW1/tW77Z1U57c=;\n\th=From:To:Cc:Date:Subject:List-Id:List-Unsubscribe:List-Archive:\n\t List-Post:List-Help:List-Subscribe:From;\n\tb=mBscFD2KV+jBeOkTwEi6BseZMiUTTeD47mz/nHQwOmarMxFPIRX3bb/WVS+Wd7EES\n\t naS+2DrK/JbEJHjOAVx7O+d9dVeXAwztfbEexbvpkD3hKzci/5mJcCoNFKXbrt/Sxb\n\t 2/ZvdD5xhGvHexArseAt8NVKGqvrLOvCRiKpFyV2jX4cBbpCDaAHmi4P7MUuMY3GS2\n\t hdCae/oCHogrcqETgtv2r/EHpSnnqs89AImY1McfQ4PBveJ1gIxKIJaA12Esq3dBGP\n\t 1HwrGg9VuMhMZ/vPra0dlxpAfuRg1MZbwtSnsffLol6Fmkox/ORm87tGFha14Py1/H\n\t 4y9lkUwJcoYdQ==","Received-SPF":"Pass (mailfrom) identity=mailfrom; client-ip=172.105.4.254;\n helo=tor.source.kernel.org; envelope-from=gregkh@linuxfoundation.org;\n receiver=","DMARC-Filter":"OpenDMARC Filter v1.4.2 smtp1.osuosl.org 0087B82060","From":"Greg Kroah-Hartman ","To":"intel-wired-lan@lists.osuosl.org,\n\tnetdev@vger.kernel.org","Cc":"linux-kernel@vger.kernel.org,\n Greg Kroah-Hartman ,\n Tony Nguyen ,\n Przemek Kitszel ,\n Andrew Lunn ,\n \"David S. Miller\" ,\n Eric Dumazet , Jakub Kicinski ,\n Paolo Abeni ,\n Piotr Raczynski , Jiri Pirko ,\n Simon Horman ,\n Michal Swiatkowski ,\n stable ","Date":"Thu, 9 Apr 2026 17:11:20 +0200","Message-ID":"<2026040919-junior-glue-10d0@gregkh>","X-Mailer":"git-send-email 2.53.0","MIME-Version":"1.0","Lines":"47","X-Developer-Signature":"v=1; a=openpgp-sha256; l=1839;\n i=gregkh@linuxfoundation.org; h=from:subject:message-id;\n bh=ld3ezbMvVsNELdIRgsT43RqN5vGdmDKDso8u1ZYLZMA=;\n b=owGbwMvMwCRo6H6F97bub03G02pJDJnXD05fFnv6UNmHJrlpXC+r/93mOC14dpthbqKszUIHu\n cVp3GbeHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRnkkM86O+Mf12sp4Z6hch\n cP6zTt0xxacTghkWLLw+v0Z2V8rEAoPLYR3rgqxl5uswAAA=","X-Developer-Key":"i=gregkh@linuxfoundation.org; a=openpgp;\n fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29","Content-Transfer-Encoding":"8bit","X-Mailman-Original-DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/simple;\n d=linuxfoundation.org;\n s=korg; t=1775747485;\n bh=ld3ezbMvVsNELdIRgsT43RqN5vGdmDKDso8u1ZYLZMA=;\n h=From:To:Cc:Subject:Date:From;\n b=P9GyPh1RHg21nZpKuzGezt9h1an5z7/4COuTMcsxGjmPs58NwXcbZkSyaeJE9mwU/\n 8Ce9H6ftVM1KJNnMgzs9ZvlLrwxka9Z7m3oECpk0GY+xuAxylFEuKy1DCBPa+RD3PV\n lIuZ1EKyRHq0+MiGcCWhKx87i2Fja0CPxlCDe24w=","X-Mailman-Original-Authentication-Results":["smtp1.osuosl.org;\n dmarc=pass (p=none dis=none)\n header.from=linuxfoundation.org","smtp1.osuosl.org;\n dkim=pass (1024-bit key,\n unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org\n header.a=rsa-sha256 header.s=korg header.b=P9GyPh1R"],"Subject":"[Intel-wired-lan] [PATCH net] ice: fix double free in\n ice_sf_eth_activate() error path","X-BeenThere":"intel-wired-lan@osuosl.org","X-Mailman-Version":"2.1.30","Precedence":"list","List-Id":"Intel Wired Ethernet Linux Kernel Driver Development\n ","List-Unsubscribe":",\n ","List-Archive":"","List-Post":"","List-Help":"","List-Subscribe":",\n ","Errors-To":"intel-wired-lan-bounces@osuosl.org","Sender":"\"Intel-wired-lan\" "},"content":"When auxiliary_device_add() fails, the aux_dev_uninit label calls\nauxiliary_device_uninit() and falls through to sf_dev_free and xa_erase.\nThe uninit invokes ice_sf_dev_release(), which already frees sf_dev via\nkfree() and erases the entry from ice_sf_aux_id. The fall-through then\ndouble-frees sf_dev and double-erases the id.\n\nThis is reachable from userspace via the devlink port function state-set\nnetlink command.\n\nFix this by returning right after uninit because the release callback\nhandles all cleanup correctly.\n\nCc: Tony Nguyen \nCc: Przemek Kitszel \nCc: Andrew Lunn \nCc: \"David S. Miller\" \nCc: Eric Dumazet \nCc: Jakub Kicinski \nCc: Paolo Abeni \nCc: Piotr Raczynski \nCc: Jiri Pirko \nCc: Simon Horman \nCc: Michal Swiatkowski \nFixes: 177ef7f1e2a0 (\"ice: base subfunction aux driver\")\nCc: stable \nAssisted-by: gregkh_clanker_t1000\nSigned-off-by: Greg Kroah-Hartman \n---\n drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 ++\n 1 file changed, 2 insertions(+)","diff":"diff --git a/drivers/net/ethernet/intel/ice/ice_sf_eth.c b/drivers/net/ethernet/intel/ice/ice_sf_eth.c\nindex 2cf04bc6edce..6bc8aa896762 100644\n--- a/drivers/net/ethernet/intel/ice/ice_sf_eth.c\n+++ b/drivers/net/ethernet/intel/ice/ice_sf_eth.c\n@@ -304,7 +304,9 @@ ice_sf_eth_activate(struct ice_dynamic_port *dyn_port,\n \treturn 0;\n \n aux_dev_uninit:\n+\t/* ice_sf_dev_release() frees sf_dev and erases the xa entry */\n \tauxiliary_device_uninit(&sf_dev->adev);\n+\treturn err;\n sf_dev_free:\n \tkfree(sf_dev);\n xa_erase:\n","prefixes":["net"]}