Uninitialized pointers with `__free` attribute can cause undefined behaviour as the memory assigned(randomly) to the pointer is freed automatically when the pointer goes out of scope
net/ethernet doesn't have any bugs related to this as of now, but it is better to initialize and assign pointers with `__free` attr in one statement to ensure proper scope-based cleanup Reported-by: Dan Carpenter <[email protected]> Closes: https://lore.kernel.org/all/[email protected]/ Signed-off-by: Ally Heev <[email protected]> --- drivers/net/ethernet/intel/ice/ice_flow.c | 5 +++-- drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 5 +++-- drivers/net/ethernet/microsoft/mana/gdma_main.c | 2 +- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c b/drivers/net/ethernet/intel/ice/ice_flow.c index 6d5c939dc8a515c252cd2b77d155b69fa264ee92..3590dacf3ee57879b3809d715e40bb290e40c4aa 100644 --- a/drivers/net/ethernet/intel/ice/ice_flow.c +++ b/drivers/net/ethernet/intel/ice/ice_flow.c @@ -1573,12 +1573,13 @@ ice_flow_set_parser_prof(struct ice_hw *hw, u16 dest_vsi, u16 fdir_vsi, struct ice_parser_profile *prof, enum ice_block blk) { u64 id = find_first_bit(prof->ptypes, ICE_FLOW_PTYPE_MAX); - struct ice_flow_prof_params *params __free(kfree); u8 fv_words = hw->blk[blk].es.fvw; int status; int i, idx; - params = kzalloc(sizeof(*params), GFP_KERNEL); + struct ice_flow_prof_params *params __free(kfree) = + kzalloc(sizeof(*params), GFP_KERNEL); + if (!params) return -ENOMEM; diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c index cbb5fa30f5a0ec778c1ee30470da3ca21cc1af24..368138715cd55cd1dadc686931cdda51c7a5130d 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c @@ -1012,7 +1012,6 @@ static int idpf_send_get_caps_msg(struct idpf_adapter *adapter) */ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter) { - struct virtchnl2_get_lan_memory_regions *rcvd_regions __free(kfree); struct idpf_vc_xn_params xn_params = { .vc_op = VIRTCHNL2_OP_GET_LAN_MEMORY_REGIONS, .recv_buf.iov_len = IDPF_CTLQ_MAX_BUF_LEN, @@ -1023,7 +1022,9 @@ static int idpf_send_get_lan_memory_regions(struct idpf_adapter *adapter) ssize_t reply_sz; int err = 0; - rcvd_regions = kzalloc(IDPF_CTLQ_MAX_BUF_LEN, GFP_KERNEL); + struct virtchnl2_get_lan_memory_regions *rcvd_regions __free(kfree) = + kzalloc(IDPF_CTLQ_MAX_BUF_LEN, GFP_KERNEL); + if (!rcvd_regions) return -ENOMEM; diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c index 43f034e180c41a595ff570b886569685a56f9fee..8dcba7ee36130d94ba3436c99a5cd5f792a2962e 100644 --- a/drivers/net/ethernet/microsoft/mana/gdma_main.c +++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c @@ -1505,7 +1505,7 @@ static int irq_setup(unsigned int *irqs, unsigned int len, int node, bool skip_first_cpu) { const struct cpumask *next, *prev = cpu_none_mask; - cpumask_var_t cpus __free(free_cpumask_var); + cpumask_var_t cpus __free(free_cpumask_var) = NULL; int cpu, weight; if (!alloc_cpumask_var(&cpus, GFP_KERNEL)) --- base-commit: c9cfc122f03711a5124b4aafab3211cf4d35a2ac change-id: 20251105-aheev-uninitialized-free-attr-net-ethernet-7d106e4ab3f7 Best regards, -- Ally Heev <[email protected]>
