> -----Original Message-----
> From: Przemek Kitszel <[email protected]>
> Sent: Monday, November 2, 2026 11:50 AM
> To: [email protected]; Oros, Petr <[email protected]>
> Cc: [email protected]; Kitszel, Przemyslaw
> <[email protected]>; Sashiko <[email protected]>
> Subject: [PATCH iwl-net 6/6] ice: register LAG event handler last in
> ice_init_lag()
>
> ice_init_lag() registers the netdevice notifier before it creates the
> LAG recipes, but when creating any of them fails, the error path frees
> the lag struct without unregistering the notifier. A failure of
> ice_init_lag() is not fatal to probe, and pf->lag is set to NULL, so
> ice_deinit_lag() won't unregister it later either. The next netdev event
> then makes
> ice_lag_event_handler() use the freed lag struct.
>
> Register the notifier last, after the recipes are created and associated
> with the profiles, so the error paths have no handler, nor queued work
> for it, that could use the lag struct or its recipes. Free the recipes
> if the registration itself fails.
>
> Fixes: ec5a6c5f79ed ("ice: process events created by lag netdev event
> handler")
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/bug/linux-e0559bca-fcfd-4435-96f2-
> 15f7e3d74184
> Signed-off-by: Przemek Kitszel <[email protected]>
> ---
> drivers/net/ethernet/intel/ice/ice_lag.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c
> b/drivers/net/ethernet/intel/ice/ice_lag.c
> index 08a17ded0ad5..c4b8af01e2af 100644
> --- a/drivers/net/ethernet/intel/ice/ice_lag.c
> +++ b/drivers/net/ethernet/intel/ice/ice_lag.c
> @@ -2601,12 +2601,6 @@ int ice_init_lag(struct ice_pf *pf)
> lag->notif_block.notifier_call = NULL;
> memset(lag->sec_vf, 0, sizeof(lag->sec_vf));
>
> - err = ice_register_lag_handler(lag);
> - if (err) {
> - dev_warn(dev, "INIT LAG: Failed to register event
> handler\n");
> - goto lag_error;
> - }
> -
> err = ice_create_lag_recipe(&pf->hw, &lag->pf_recipe,
> ice_dflt_vsi_rcp, 1);
I'm afraid act_act_recipe is allocated but never released on the normal
teardown path.
See ice_deinit_lag() it has just kfree(lag);
...
