]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bnxt_en: Handle partially initialized auxiliary devices
authorRuoyu Wang <ruoyuw560@gmail.com>
Sat, 11 Jul 2026 16:37:16 +0000 (00:37 +0800)
committerPaolo Abeni <pabeni@redhat.com>
Fri, 17 Jul 2026 10:43:57 +0000 (12:43 +0200)
commit1cb8553c02e93e5a150cebd42f9ee3db0ece4707
tree2797b22625cce076c1ae05976e35367a00d6294f
parente0b5252a59383b77d1b8dbeda00b7184dd95f4d3
bnxt_en: Handle partially initialized auxiliary devices

bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
used by bnxt_aux_dev_release() are initialized.  After
auxiliary_device_init() succeeds, later errors must unwind with
auxiliary_device_uninit(), which invokes the release callback.

The release callback assumes that aux_priv->id, aux_priv->edev,
edev->net and edev->ulp_tbl are all populated.  If allocation fails
after auxiliary_device_init(), the release path can otherwise dereference
or clear partially initialized state.

Allocate and attach the bnxt_en_dev and ULP table before calling
auxiliary_device_init(), so the release callback only sees a fully
initialized auxiliary private object.  If auxiliary_device_init() itself
fails, free those allocations directly because device_initialize() has not
run and the release callback will not be invoked.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 194fad5b2781 ("bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Link: https://patch.msgid.link/20260711163716.3996929-1-ruoyuw560@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c