__stmmac_open() copies the freshly allocated dma_conf into priv->dma_conf via memcpy() before it can fail, e.g. in stmmac_request_irq(). When it does fail, the callers free the dma_conf descriptor resources and the struct itself, but priv->dma_conf still holds pointers to those freed resources, a use-after-free that triggers when a subsequent stmmac_release() or another MTU change releases the resources again. Undo the memcpy in the error path by zeroing priv->dma_conf, leaving the state consistent regardless of the caller. Fixes: 30134b7c47bd2 ("net: ethernet: stmicro: stmmac: fix possible memory leak in __stmmac_open") Signed-off-by: ZhaoJinming --- Changes in v2: - Move the clearing of priv->dma_conf from stmmac_change_mtu() into __stmmac_open() error path, undoing the memcpy() at the point where it was made and covering both callers. - Link to v1: https://lore.kernel.org/r/20260903-fix-stmmac-mtu-change-use-after-free-v1-1-c81dc7d6d18a@uniontech.com --- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c index 24656b35350b14454fb10deced6516eb89e2c0c9..4369e64faf9f878aa20ac5075705044f55c5f8bf 100644 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c @@ -4190,6 +4190,7 @@ static int __stmmac_open(struct net_device *dev, stmmac_release_ptp(priv); init_error: + memset(&priv->dma_conf, 0, sizeof(priv->dma_conf)); return ret; } --- base-commit: a500db7819c50db59e55f1b4fa1c3baa5a2616f3 change-id: 20260903-fix-stmmac-mtu-change-use-after-free-693da6eb4a30 Best regards, -- ZhaoJinming