[PATCH net v3 0/3] net: fealnx: fix card-index overflow and PCI device teardown

[PATCH net v3 0/3] net: fealnx: fix card-index overflow and PCI device teardown

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

Changes since v2:
Patch 1:
  - Reworded patch text to avoid overconfident claims;
    no functional changes.
Patch 3:
  - Replaced IDA fix with simple card_idx check as requested
    by Andrew Lunn.

Link: https://lore.kernel.org/all/20261002140954.261779-1-r.zhambakiev@prosoftsystems.ru/

Radiy Zhambakiev (3):
  net: fealnx: fix teardown order in remove
  net: fealnx: disable the PCI device on remove and probe failure
  net: fealnx: bound card_idx to prevent out-of-bounds access

 drivers/net/ethernet/fealnx.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

-- 
2.53.0

[PATCH net v3 1/3] net: fealnx: fix teardown order in remove

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

fealnx_remove_one() frees the DMA rings before unregistering the
netdev, while the interface may still be up, which leaves a
window where freed memory can be accessed.

Call unregister_netdev() first so dev_close() completes before
the rings are freed.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index bdc38aac5850..68194c9ef332 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -682,11 +682,11 @@ static void fealnx_remove_one(struct pci_dev *pdev)
 	if (dev) {
 		struct netdev_private *np = netdev_priv(dev);
 
+		unregister_netdev(dev);
 		dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
 				  np->tx_ring_dma);
 		dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
 				  np->rx_ring_dma);
-		unregister_netdev(dev);
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
-- 
2.53.0

Re: [PATCH net v3 1/3] net: fealnx: fix teardown order in remove

[Andrew Lunn]

On Mon, Oct 19, 2026 at 01:42:49PM +0000, Жамбакиев Радий Рикардинович wrote:
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> fealnx_remove_one() frees the DMA rings before unregistering the
> netdev, while the interface may still be up, which leaves a
> window where freed memory can be accessed.
> 
> Call unregister_netdev() first so dev_close() completes before
> the rings are freed.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")

Seems unlikely this bothers anybody if you are referencing this
commit. Please submit to net-next, in three weeks time when the merge
window closes.

	Andrew

[PATCH net v3 2/3] net: fealnx: disable the PCI device on remove and probe failure

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

pci_enable_device() is called in probe, but the device is never
disabled on probe failure or remove. Device remains enabled and
bus mastering stays active.

Add pci_disable_device() to the probe error unwind and to
fealnx_remove_one(), after all other resources have been released.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index 68194c9ef332..b5e96c7037f3 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -502,12 +502,13 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	if (len < MIN_REGION_SIZE) {
 		dev_err(&pdev->dev,
 			   "region size %ld too small, aborting\n", len);
-		return -ENODEV;
+		err = -ENODEV;
+		goto err_out_disable;
 	}
 
-	i = pci_request_regions(pdev, boardname);
-	if (i)
-		return i;
+	err = pci_request_regions(pdev, boardname);
+	if (err)
+		goto err_out_disable;
 
 	irq = pdev->irq;
 
@@ -671,6 +672,8 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	pci_iounmap(pdev, ioaddr);
 err_out_res:
 	pci_release_regions(pdev);
+err_out_disable:
+	pci_disable_device(pdev);
 	return err;
 }
 
@@ -690,6 +693,7 @@ static void fealnx_remove_one(struct pci_dev *pdev)
 		pci_iounmap(pdev, np->mem);
 		free_netdev(dev);
 		pci_release_regions(pdev);
+		pci_disable_device(pdev);
 	} else
 		printk(KERN_ERR "fealnx: remove for unknown device\n");
 }
-- 
2.53.0

[PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Жамбакиев Радий Рикардинович]

From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

card_idx is a static counter that is incremented on every
probe. It can overflow and wrap to a negative value, which
then indexes options[] and full_duplex[] out of bounds.
Large values also no longer fit in the 12-byte boardname[]
buffer.

Bound card_idx to 99999, the largest value that still fits
into boardname, and fail the probe for any card beyond that.

fealnx is an old driver that cannot be tested properly on
real hardware, so a minimal best-effort guard was chosen
over a larger rework.

Found by Linux Verification Center (linuxtesting.org)

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
---
 drivers/net/ethernet/fealnx.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
index b5e96c7037f3..d5931c0314fc 100644
--- a/drivers/net/ethernet/fealnx.c
+++ b/drivers/net/ethernet/fealnx.c
@@ -41,6 +41,7 @@ static int rx_copybreak;
 /* interoperability.                                            */
 /* The media type is usually passed in 'options[]'.             */
 #define MAX_UNITS 8		/* More are supported, limit only on options */
+#define MAX_CARD_IDX		99999
 static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
 
@@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
 	int bar = 1;
 #endif
 
+	if (card_idx >= MAX_CARD_IDX) {
+		dev_err(&pdev->dev, "card_idx is too big %d, aborting", card_idx);
+		return -ENODEV;
+	}
 	card_idx++;
 	sprintf(boardname, "fealnx%d", card_idx);
 
-- 
2.53.0

Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Fedor Pchelkin]

On Mon, 19. Oct 13:43, Жамбакиев Радий Рикардинович wrote:
> diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c
> index b5e96c7037f3..d5931c0314fc 100644
> --- a/drivers/net/ethernet/fealnx.c
> +++ b/drivers/net/ethernet/fealnx.c
> @@ -41,6 +41,7 @@ static int rx_copybreak;
>  /* interoperability.                                            */
>  /* The media type is usually passed in 'options[]'.             */
>  #define MAX_UNITS 8		/* More are supported, limit only on options */
> +#define MAX_CARD_IDX		99999
>  static int options[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
>  static int full_duplex[MAX_UNITS] = { -1, -1, -1, -1, -1, -1, -1, -1 };
>  
> @@ -489,6 +490,10 @@ static int fealnx_init_one(struct pci_dev *pdev,
>  	int bar = 1;
>  #endif
>  
> +	if (card_idx >= MAX_CARD_IDX) {
> +		dev_err(&pdev->dev, "card_idx is too big %d, aborting", card_idx);
> +		return -ENODEV;
> +	}
>  	card_idx++;
>  	sprintf(boardname, "fealnx%d", card_idx);

There is a compiler warning with a W=1 build the testing bots will
soon complain about:

drivers/net/ethernet/fealnx.c:498:35: warning: '%d' directive writing between 1 and 11 bytes into a region of size 6 [-Wformat-overflow=]
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |                                   ^~
drivers/net/ethernet/fealnx.c:498:28: note: directive argument in the range [-2147483647, 99999]
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |                            ^~~~~~~~~~
drivers/net/ethernet/fealnx.c:498:9: note: 'sprintf' output between 8 and 18 bytes into a destination of size 12
  498 |         sprintf(boardname, "fealnx%d", card_idx);
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Re: [PATCH net v3 3/3] net: fealnx: bound card_idx to prevent out-of-bounds access

[Andrew Lunn]

On Mon, Oct 19, 2026 at 01:43:03PM +0000, Жамбакиев Радий Рикардинович wrote:
> From: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>
> 
> card_idx is a static counter that is incremented on every
> probe. It can overflow and wrap to a negative value, which
> then indexes options[] and full_duplex[] out of bounds.
> Large values also no longer fit in the 12-byte boardname[]
> buffer.
> 
> Bound card_idx to 99999, the largest value that still fits
> into boardname, and fail the probe for any card beyond that.
> 
> fealnx is an old driver that cannot be tested properly on
> real hardware, so a minimal best-effort guard was chosen
> over a larger rework.
> 
> Found by Linux Verification Center (linuxtesting.org)
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radiy Zhambakiev <r.zhambakiev@prosoftsystems.ru>

Please drop the Fixes: when you repost to net-next. This is one of
those theoretical fixes which never happens and nobody cares about, so
there is no need to backport it to stable.

Reviewed-by: Andrew Lunn <andrew@lunn.ch>

    Andrew