bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp. If the fp allocation fails, the error path calls bnx2x_free_mem_bp(), which dereferences bp->fp in a loop bounded by the non-zero bp->fp_array_size, causing a NULL pointer dereference. Move the bp->fp_array_size assignment to after bp->fp is set so that the loop in bnx2x_free_mem_bp() naturally becomes a no-op when bp->fp is NULL, since bp is zero-initialized and fp_array_size remains 0. Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan@kylinos.cn Suggested-by: Vadim Fedorenko Cc: stable@vger.kernel.org Signed-off-by: Jiangshan Yi --- Changes in v2: - Remove the defensive NULL guard in bnx2x_free_mem_bp() as suggested by Vadim Fedorenko, since the assignment-order fix alone is sufficient to prevent the NULL pointer dereference (bp is zero-initialized so fp_array_size remains 0 when allocation fails). drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index 5b2640bd31c3..926ffe3e2c43 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -4742,13 +4742,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) /* fp array: RSS plus CNIC related L2 queues */ fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp); - bp->fp_array_size = fp_array_size; - BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size); + BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size); - fp = kzalloc_objs(*fp, bp->fp_array_size); + fp = kzalloc_objs(*fp, fp_array_size); if (!fp) goto alloc_err; bp->fp = fp; + bp->fp_array_size = fp_array_size; for (i = 0; i < bp->fp_array_size; i++) { fp[i].tpa_info = kzalloc_objs(struct bnx2x_agg_info, -- 2.25.1