If idpf_probe() fails after idpf_cfg_device() succeeds, pci_set_drvdata() leaves a pointer to freed memory. Clear it before freeing the adapter to prevent potential use-after-free if anything accesses pci_get_drvdata().
Reviewed-by: Przemek Kitszel <[email protected]> Reviewed-by: Aleksandr Loktionov <[email protected]> Signed-off-by: Paul Greenwalt <[email protected]> --- drivers/net/ethernet/intel/idpf/idpf_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/idpf/idpf_main.c b/drivers/net/ethernet/intel/idpf/idpf_main.c index 807608899084..6f9579c39342 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_main.c +++ b/drivers/net/ethernet/intel/idpf/idpf_main.c @@ -364,6 +364,7 @@ static int idpf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_init_wq: idpf_decfg_device(adapter); err_free: + pci_set_drvdata(pdev, NULL); kfree(adapter); return err; } -- 2.52.0
