[PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[Bhargava Marreddy]

Four independent fixes for existing bugs in the bnge driver's probe/open
path:

 [1/4] Unwind bnge_alloc_core() incrementally to avoid a NULL deref when an
       allocation fails.
 [2/4] Require aux_msix + min vectors so nq_nr_rings cannot end up 0.
 [3/4] Treat an irq_set_affinity_hint() failure as a warning, not an open
       failure.
 [4/4] Clear bd->netdev when bnge_netdev_alloc() fails so it does not
       point at a freed net_device.

Bhargava Marreddy (4):
  bnge: fix NULL deref in bnge_alloc_core() on failure
  bnge: require NQ vectors beyond aux reservation
  bnge: do not fail open if IRQ affinity hint fails
  bnge: clear bd->netdev on allocation failure

 .../net/ethernet/broadcom/bnge/bnge_netdev.c  | 51 +++++++++++++------
 .../net/ethernet/broadcom/bnge/bnge_resc.c    |  2 +-
 2 files changed, 37 insertions(+), 16 deletions(-)

-- 
2.47.3

[PATCH net 1/4] bnge: fix NULL deref in bnge_alloc_core() on failure

[Bhargava Marreddy]

bnge_alloc_core() previously jumped to a single error label that called
bnge_free_core() to unwind. However, bnge_free_core() assumes a fully
initialized state and dereferences rx/tx ring arrays unconditionally.
If ring allocations fail early, this causes a near-NULL dereference.

Introduce a standard goto ladder to unwind only the resources that were
successfully allocated, preventing NULL dereferences.

Fixes: 0259379037ca ("bng_en: Add initial support for RX and TX rings")
Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Reviewed-by: Ramakrishna Koduri <ramakrishna.koduri@broadcom.com>
---
 .../net/ethernet/broadcom/bnge/bnge_netdev.c  | 46 ++++++++++++++-----
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index a4288f0258f8..bf101eded3bf 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -1243,7 +1243,7 @@ static int bnge_alloc_core(struct bnge_net *bn)
 
 	bn->rx_ring = kzalloc_objs(struct bnge_rx_ring_info, bd->rx_nr_rings);
 	if (!bn->rx_ring)
-		goto err_free_core;
+		goto err_free_bnapi;
 
 	for (i = 0; i < bd->rx_nr_rings; i++) {
 		struct bnge_rx_ring_info *rxr = &bn->rx_ring[i];
@@ -1258,12 +1258,12 @@ static int bnge_alloc_core(struct bnge_net *bn)
 
 	bn->tx_ring = kzalloc_objs(struct bnge_tx_ring_info, bd->tx_nr_rings);
 	if (!bn->tx_ring)
-		goto err_free_core;
+		goto err_free_rx_ring;
 
 	bn->tx_ring_map = kcalloc(bd->tx_nr_rings, sizeof(u16),
 				  GFP_KERNEL);
 	if (!bn->tx_ring_map)
-		goto err_free_core;
+		goto err_free_tx_ring;
 
 	if (bd->flags & BNGE_EN_SHARED_CHNL)
 		j = 0;
@@ -1289,42 +1289,64 @@ static int bnge_alloc_core(struct bnge_net *bn)
 
 	rc = bnge_alloc_ring_stats(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_tx_ring_map;
 
 	bnge_init_stats(bn);
 
 	rc = bnge_alloc_vnics(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_ring_stats;
 
 	rc = bnge_alloc_nq_arrays(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_vnics;
 
 	bnge_init_ring_struct(bn);
 
 	rc = bnge_alloc_rx_rings(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_nq_arrays;
 
 	rc = bnge_alloc_tx_rings(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_rx_rings;
 
 	rc = bnge_alloc_nq_tree(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_tx_rings;
 
 	bn->vnic_info[BNGE_VNIC_DEFAULT].flags |= BNGE_VNIC_RSS_FLAG |
 						  BNGE_VNIC_MCAST_FLAG |
 						  BNGE_VNIC_UCAST_FLAG;
 	rc = bnge_alloc_vnic_attributes(bn);
 	if (rc)
-		goto err_free_core;
+		goto err_free_nq_tree;
 	return 0;
 
-err_free_core:
-	bnge_free_core(bn);
+err_free_nq_tree:
+	bnge_free_nq_tree(bn);
+err_free_tx_rings:
+	bnge_free_tx_rings(bn);
+err_free_rx_rings:
+	bnge_free_rx_rings(bn);
+err_free_nq_arrays:
+	bnge_free_nq_arrays(bn);
+err_free_vnics:
+	bnge_free_vnics(bn);
+err_free_ring_stats:
+	bnge_free_ring_stats(bn);
+err_free_tx_ring_map:
+	kfree(bn->tx_ring_map);
+	bn->tx_ring_map = NULL;
+err_free_tx_ring:
+	kfree(bn->tx_ring);
+	bn->tx_ring = NULL;
+err_free_rx_ring:
+	kfree(bn->rx_ring);
+	bn->rx_ring = NULL;
+err_free_bnapi:
+	kfree(bn->bnapi);
+	bn->bnapi = NULL;
 	return rc;
 }
 
-- 
2.47.3

[PATCH net 2/4] bnge: require NQ vectors beyond aux reservation

[Bhargava Marreddy]

If exactly aux_msix vectors are granted, probe continues with zero NQ
vectors. This leads to zero-sized allocations and out-of-bounds array
accesses during ring setup.

Require at least 'min' vectors beyond the aux reservation to ensure the
driver always has an NQ vector to work with.

Fixes: 18a975389fcc ("bng_en: Add irq allocation support")
Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Reviewed-by: Ramakrishna Koduri <ramakrishna.koduri@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_resc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
index 4711dd4945ff..7c26943c5cb3 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_resc.c
@@ -382,7 +382,7 @@ int bnge_alloc_irqs(struct bnge_dev *bd)
 	irqs_demand = pci_alloc_irq_vectors(bd->pdev, min, irqs_demand,
 					    PCI_IRQ_MSIX);
 	aux_msix = bnge_aux_get_msix(bd);
-	if (irqs_demand < 0 || irqs_demand < aux_msix) {
+	if (irqs_demand < 0 || irqs_demand < aux_msix + min) {
 		rc = -ENODEV;
 		goto err_free_irqs;
 	}
-- 
2.47.3

[PATCH net 3/4] bnge: do not fail open if IRQ affinity hint fails

[Bhargava Marreddy]

IRQ affinity hints are advisory and not fatal to driver operations.
On uniprocessor builds (CONFIG_SMP=n), irq_set_affinity_hint() always
returns -EINVAL, which currently prevents ndo_open() from succeeding.

Log a warning and continue instead of failing open on affinity error.

Fixes: bd06d729722e ("bng_en: Add initial support for CP and NQ rings")
Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Reviewed-by: Ramakrishna Koduri <ramakrishna.koduri@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index bf101eded3bf..ca14d13fa3e9 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -2666,12 +2666,10 @@ static int bnge_request_irq(struct bnge_net *bn)
 			irq->have_cpumask = 1;
 			cpumask_set_cpu(cpumask_local_spread(i, numa_node),
 					irq->cpu_mask);
-			rc = irq_set_affinity_hint(irq->vector, irq->cpu_mask);
-			if (rc) {
+			if (irq_set_affinity_hint(irq->vector, irq->cpu_mask)) {
 				netdev_warn(bn->netdev,
 					    "Set affinity failed, IRQ = %d\n",
 					    irq->vector);
-				goto err_free_irq;
 			}
 		}
 	}
-- 
2.47.3

[PATCH net 4/4] bnge: clear bd->netdev on allocation failure

[Bhargava Marreddy]

If bnge_netdev_alloc() fails after storing the net_device pointer in
bd->netdev, it calls free_netdev() but leaves bd->netdev as a dangling
pointer.

Explicitly set bd->netdev to NULL on the error path to prevent potential
use-after-free or invalid pointer dereferences.

Fixes: 13a68c1ed754 ("bng_en: Add a network device")
Signed-off-by: Bhargava Marreddy <bhargava.marreddy@broadcom.com>
Reviewed-by: Dharmender Garg <dharmender.garg@broadcom.com>
Reviewed-by: Rajashekar Hudumula <rajashekar.hudumula@broadcom.com>
Reviewed-by: Ramakrishna Koduri <ramakrishna.koduri@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnge/bnge_netdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
index ca14d13fa3e9..7dbe853a5a47 100644
--- a/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
+++ b/drivers/net/ethernet/broadcom/bnge/bnge_netdev.c
@@ -3551,6 +3551,7 @@ int bnge_netdev_alloc(struct bnge_dev *bd, int max_irqs)
 	destroy_workqueue(bn->bnge_pf_wq);
 err_netdev:
 	free_netdev(netdev);
+	bd->netdev = NULL;
 	return rc;
 }
 
-- 
2.47.3

Re: [PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

 - What hardware the change was tested on. For driver fixes please
   mention the device (and if relevant firmware version) used for
   testing, or say that the change was not tested on real hardware.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.

Re: [PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[Bhargava Chenna Marreddy]

[-- Attachment #1.1: Type: text/plain, Size: 1715 bytes --]

Hi,

To provide the requested context for reviewers:

- Discovery: Identified during review of the "bnge: Support async
  events while down" series -- three were flagged by Sashiko, and one
  was flagged by Simon Horman.

- Trigger: Identified via code review and static analysis (potential
  issues in failure handling and IRQ setup paths).

- Testing: Tested on physical bnge hardware; compile-tested and
  verified checkpatch --strict clean.

Regards,
Bhargava, Marreddy.


On Mon, Oct 5, 2026 at 5:53 PM <netdev-bot+sinfo@kernel.org> wrote:

> Hi!
>
> This is an automated message. This series looks like a fix, but its
> commit messages seem to be missing some information:
>
>  - How the issue was discovered, e.g. hit in production, hit during
>    development, syzbot report, manual code inspection, LLM or static
>    analysis tool scan.
>
>  - Whether the issue was actually triggered, or is only theoretical
>    (e.g. found by code inspection). If it was triggered please include
>    the symptoms, like the stack trace or error messages.
>
>  - What hardware the change was tested on. For driver fixes please
>    mention the device (and if relevant firmware version) used for
>    testing, or say that the change was not tested on real hardware.
>
> Please do not repost the series just to address the above. Instead,
> reply to this email with the missing information, so that reviewers
> can take it into account. If the series needs another revision for
> other reasons, please include the information in the commit messages
> then.
>
> The evaluation is done by an LLM so it may be wrong, if you think
> that is the case please reply and explain.
>

[-- Attachment #1.2: Type: text/html, Size: 2252 bytes --]

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5496 bytes --]

Re: [PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[Przemek Kitszel]

On 10/5/26 2:17 PM, Bhargava Marreddy wrote:
> Four independent fixes for existing bugs in the bnge driver's probe/open
> path:
> 
>   [1/4] Unwind bnge_alloc_core() incrementally to avoid a NULL deref when an
>         allocation fails.
>   [2/4] Require aux_msix + min vectors so nq_nr_rings cannot end up 0.
>   [3/4] Treat an irq_set_affinity_hint() failure as a warning, not an open
>         failure.
>   [4/4] Clear bd->netdev when bnge_netdev_alloc() fails so it does not
>         point at a freed net_device.
> 
> Bhargava Marreddy (4):
>    bnge: fix NULL deref in bnge_alloc_core() on failure
>    bnge: require NQ vectors beyond aux reservation
>    bnge: do not fail open if IRQ affinity hint fails
>    bnge: clear bd->netdev on allocation failure
> 
>   .../net/ethernet/broadcom/bnge/bnge_netdev.c  | 51 +++++++++++++------
>   .../net/ethernet/broadcom/bnge/bnge_resc.c    |  2 +-
>   2 files changed, 37 insertions(+), 16 deletions(-)
> 

nothing controversial,
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>

Re: [PATCH net 0/4] bnge: Fix error-path and IRQ setup bugs in probe/open

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon,  5 Oct 2026 17:47:00 +0530 you wrote:
> Four independent fixes for existing bugs in the bnge driver's probe/open
> path:
> 
>  [1/4] Unwind bnge_alloc_core() incrementally to avoid a NULL deref when an
>        allocation fails.
>  [2/4] Require aux_msix + min vectors so nq_nr_rings cannot end up 0.
>  [3/4] Treat an irq_set_affinity_hint() failure as a warning, not an open
>        failure.
>  [4/4] Clear bd->netdev when bnge_netdev_alloc() fails so it does not
>        point at a freed net_device.
> 
> [...]

Here is the summary with links:
  - [net,1/4] bnge: fix NULL deref in bnge_alloc_core() on failure
    https://git.kernel.org/netdev/net-next/c/cc7a4a3138a4
  - [net,2/4] bnge: require NQ vectors beyond aux reservation
    https://git.kernel.org/netdev/net-next/c/f94521b9d407
  - [net,3/4] bnge: do not fail open if IRQ affinity hint fails
    https://git.kernel.org/netdev/net-next/c/dc9a69f4d853
  - [net,4/4] bnge: clear bd->netdev on allocation failure
    https://git.kernel.org/netdev/net-next/c/21162b65d468

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html