Commit c4ea7d89 authored by Guangshuo Li's avatar Guangshuo Li Committed by Jakub Kicinski
Browse files

net: mana: fix use-after-free in add_adev() error path 



If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls
auxiliary_device_uninit(adev).

The auxiliary device has its release callback set to adev_release(),
which frees the containing struct mana_adev. Since adev is embedded in
struct mana_adev, the subsequent fall-through to init_fail and access
to adev->id may result in a use-after-free.

Fix this by saving the allocated auxiliary device id in a local
variable before calling auxiliary_device_add(), and use that saved id
in the cleanup path after auxiliary_device_uninit().

Fixes: a69839d4 ("net: mana: Add support for auxiliary device")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarLong Li <longli@microsoft.com>
Signed-off-by: default avatarGuangshuo Li <lgs201920130244@gmail.com>
Link: https://patch.msgid.link/20260323165730.945365-1-lgs201920130244@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 815980fe

drivers/net/ethernet/microsoft/mana/mana_en.c

+4 −2
Original line number Diff line number Diff line
@@ -3425,6 +3425,7 @@ static int add_adev(struct gdma_dev *gd, const char *name) 
	struct auxiliary_device *adev;

	struct mana_adev *madev;

	int ret;

	int id;



	madev = kzalloc_obj(*madev);

	if (!madev)
@@ -3434,7 +3435,8 @@ static int add_adev(struct gdma_dev *gd, const char *name) 
	ret = mana_adev_idx_alloc();

	if (ret < 0)

		goto idx_fail;

	adev->id = ret;

	id = ret;

	adev->id = id;



	adev->name = name;

	adev->dev.parent = gd->gdma_context->dev;
@@ -3460,7 +3462,7 @@ static int add_adev(struct gdma_dev *gd, const char *name) 
	auxiliary_device_uninit(adev);



init_fail:

	mana_adev_idx_free(adev->id);

	mana_adev_idx_free(id);



idx_fail:

	kfree(madev);