Re: [PATCH] net: ethernet: mtk_wed: fix double free in mtk_wed_rx_reset

[Lorenzo Bianconi <lorenzo@kernel.org>]

[-- Attachment #1: Type: text/plain, Size: 1363 bytes --]

> mtk_wed_free_rx_buffer already calls mtk_wed_hwrro_free_buffer but
> mtk_wed_rx_reset calls both subsequently. This would cause double free
> because dma_free_coherent doesn't set freed desc to NULL.
> 
> Fix this by removing the mtk_wed_hwrro_free_buffer in mtk_wed_rx_reset.
> 
> Compile tested only because I don't own v3 hardware.
> 
> Fixes: 1543b8ff02f0 ("net: ethernet: mtk_wed: add wed 3.0 reset support")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/map/216156
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhi-Jun You <hujy652@gmail.com>

Reviewed-by: Lorenzo Bianconi <lorenzo@kernel.org>

> ---
>  drivers/net/ethernet/mediatek/mtk_wed.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
> index f40ac5794341..5e9674c9e63a 100644
> --- a/drivers/net/ethernet/mediatek/mtk_wed.c
> +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
> @@ -1723,7 +1723,6 @@ mtk_wed_rx_reset(struct mtk_wed_device *dev)
>  				   false);
>  	}
>  	mtk_wed_free_rx_buffer(dev);
> -	mtk_wed_hwrro_free_buffer(dev);
>  
>  	return 0;
>  }
> 
> ---
> base-commit: 11140c51df12e594d6bf2c8d2af5dec63b0219ac
> change-id: 20261104-double-free-b6b95c2539c6
> 
> Best regards,
> --  
> Zhi-Jun You <hujy652@gmail.com>
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]