]> git.ipfire.org Git - thirdparty/linux.git/commit
net: mana: remove double CQ cleanup in mana_create_rxq error path
authorDipayaan Roy <dipayanroy@linux.microsoft.com>
Thu, 30 Apr 2026 03:57:54 +0000 (20:57 -0700)
committerPaolo Abeni <pabeni@redhat.com>
Tue, 5 May 2026 10:16:23 +0000 (12:16 +0200)
commit3985c9a56da49af8b2e45cb1fa55c03c89b1d471
tree7a625f23b27038bbd3a069adb7aacdd8ddf1d80e
parent2a1c691182823a5c149d502ac153e249ee697b4a
net: mana: remove double CQ cleanup in mana_create_rxq error path

In mana_create_rxq(), the error cleanup path calls mana_destroy_rxq()
followed by mana_deinit_cq(). This is incorrect for two reasons:

1. mana_destroy_rxq() already calls mana_deinit_cq() internally,
   so the CQ's GDMA queue is destroyed twice.

2. mana_destroy_rxq() frees the rxq via kfree(rxq) before returning.
   The subsequent mana_deinit_cq(apc, cq) then operates on freed memory
   since cq points to &rxq->rx_cq, which is embedded in the
   already-freed rxq structure — a use-after-free.

Remove the redundant mana_deinit_cq() call from the error path since
mana_destroy_rxq() already handles CQ cleanup. mana_deinit_cq() is
itself safe for an uninitialized CQ as it checks for a NULL gdma_cq
before proceeding.

Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network Adapter (MANA)")
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Signed-off-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
Reviewed-by: Aditya Garg <gargaditya@linux.microsoft.com>
Link: https://patch.msgid.link/20260430035935.1859220-4-dipayanroy@linux.microsoft.com
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
drivers/net/ethernet/microsoft/mana/mana_en.c