net: mana: Fix possible double free in error handling path

[ Upstream commit 1864b8224195d0e43ddb92a8151f54f6562090cc ]

When auxiliary_device_add() returns error and then calls
auxiliary_device_uninit(), callback function adev_release
calls kfree(madev). We shouldn't call kfree(madev) again
in the error handling path. Set 'madev' to NULL.

Fixes: a69839d4327d ("net: mana: Add support for auxiliary device")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://patch.msgid.link/20240625130314.2661257-1-make24@iscas.ac.cn
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index d8af5e7e15b4d82ebf20c610cea7ab2ec19625a8..191d50ba646d8f44743d10fee49aa9cdbd1ed47f 100644 (file)
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -2800,6 +2800,8 @@ static int add_adev(struct gdma_dev *gd)
        if (ret)
                goto init_fail;
 
+       /* madev is owned by the auxiliary device */
+       madev = NULL;
        ret = auxiliary_device_add(adev);
        if (ret)
                goto add_fail;