Thread (9 messages) 9 messages, 4 authors, 4d ago

[PATCH net 4/4] bnge: clear bd->netdev on allocation failure

flat view
COOLING4d IN LINUX-NEXT: 3 (0M)

From: Bhargava Marreddy <hidden>
Date: 2026-10-05 12:18:59
Also in: lkml
Subsystem: broadcom bng_en 800 gigabit ethernet driver, networking drivers, the rest · Maintainers: Vikas Gupta, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds

3 review trailers; queued in linux-next as 21162b65d468 on 2026-10-07.

If bnge_netdev_alloc() fails after storing the net_device pointer in
bd->netdev, it calls free_netdev() but leaves bd->netdev as a dangling
pointer.

Explicitly set bd->netdev to NULL on the error path to prevent potential
use-after-free or invalid pointer dereferences.

Fixes: 13a68c1ed754 ("bng_en: Add a network device")
Signed-off-by: Bhargava Marreddy <redacted>
Reviewed-by: Dharmender Garg <redacted>
Reviewed-by: Rajashekar Hudumula <redacted>
Reviewed-by: Ramakrishna Koduri <redacted>
---
 drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 1 +
 1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index ca14d13fa3e9..7dbe853a5a47 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -3551,6 +3551,7 @@ int bnge_netdev_alloc(struct bnge_dev *bd, int max_irqs)
 	destroy_workqueue(bn->bnge_pf_wq);
 err_netdev:
 	free_netdev(netdev);
+	bd->netdev = NULL;
 	return rc;
 }
 
-- 
2.47.3
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help