From: Sven Eckelmann When batadv_bla_init() fails to initialize the backbone_hash, it is freeing the (previously) allocated claim_hash. The initialization function will then return an error and the net_device initialization will stop. The destructor will be called instead and (indirectly via batadv_mesh_free() -> batadv_bla_free()) will try to free the bat_priv->bla.claim_hash again. The pointer must therefore be set to NULL after freeing it in the initialization error path. Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260831135117.574836-1-sw%40simonwunderlich.de?part=6 Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich --- net/batman-adv/bridge_loop_avoidance.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c index ad6ab4a50658f..a96f269da8d37 100644 --- a/net/batman-adv/bridge_loop_avoidance.c +++ b/net/batman-adv/bridge_loop_avoidance.c @@ -1625,6 +1625,7 @@ int batadv_bla_init(struct batadv_priv *bat_priv) bat_priv->bla.backbone_hash = batadv_hash_new(32); if (!bat_priv->bla.backbone_hash) { batadv_hash_destroy(bat_priv->bla.claim_hash); + bat_priv->bla.claim_hash = NULL; return -ENOMEM; } -- 2.47.3