Sashiko pointed out an issue where error path in i40e_vsi_reinit_setup() released ring memory but then when freeing q_vectors, the rings mapped to q_vectors where touched which implies a regular use-after-free bug. Apparently i40e_vsi_setup() has the same problem, so swap the allocation and freeing order and fix the 13 year old bug. Fixes: 41c445ff0f48 ("i40e: main driver core") Signed-off-by: Maciej Fijalkowski --- drivers/net/ethernet/intel/i40e/i40e_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index 471fa7f7b643..4adc7b0fb2f4 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -14460,14 +14460,14 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type, fallthrough; case I40E_VSI_FDIR: /* set up vectors and rings if needed */ - ret = i40e_vsi_setup_vectors(vsi); - if (ret) - goto err_msix; - ret = i40e_alloc_rings(vsi); if (ret) goto err_rings; + ret = i40e_vsi_setup_vectors(vsi); + if (ret) + goto err_qvec; + /* map all of the rings to the q_vectors */ i40e_vsi_map_rings_to_vectors(vsi); @@ -14487,10 +14487,10 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type, return vsi; err_config: + i40e_vsi_free_q_vectors(vsi); +err_qvec: i40e_vsi_clear_rings(vsi); err_rings: - i40e_vsi_free_q_vectors(vsi); -err_msix: if (vsi->netdev_registered) { vsi->netdev_registered = false; unregister_netdev(vsi->netdev); -- 2.43.0