diff options
| author | Nikhil P. Rao <nikhil.rao@amd.com> | 2026-10-15 16:03:30 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-21 17:10:54 -0700 |
| commit | d90d1a768b3b022c52beafb3a4701ee2ee3d2b5e (patch) | |
| tree | af8d20ae6cb8ede7e063bf8ba1c4d7753fc8c3e6 /scripts/Makefile.thinlto | |
| parent | 6acb220312d58cffe6591c6adc90dbfd042cc1af (diff) | |
| download | linux-d90d1a768b3b022c52beafb3a4701ee2ee3d2b5e.tar.gz linux-d90d1a768b3b022c52beafb3a4701ee2ee3d2b5e.zip | |
ionic: fix port_info use-after-free on firmware recovery
ionic_port_init() allocates port_info when the pointer is NULL, but its
error path frees it without checking whether this call allocated it.
Before commit ddc5911b9bd2 ("ionic: call ionic_port_init after
fw-upgrade") the function returned early when the buffer already
existed, so the two were symmetric.
Since then a failed PORT_INIT on either recovery path - fw_up or
reset_done - frees a buffer an earlier init owns, while the netdev is
registered and the ethtool ops are reading it.
Free only what this call allocated.
Fixes: ddc5911b9bd2 ("ionic: call ionic_port_init after fw-upgrade")
Signed-off-by: Nikhil P. Rao <nikhil.rao@amd.com>
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/20261015-ionic-port-info-lifetime-v2-1-57232013fd79@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions