On Fri, Apr 17, 2026 at 03:09:53PM +0100, Simon Horman wrote: > This is an AI-generated review of your patch. The human sending this > email has considered the AI review valid, or at least plausible. > > For local reproduction steps see > https://netdev-ai.bots.linux.dev/ai-local.html > --- > net: mana: Guard mana_remove against double invocation > > If PM resume fails (e.g., mana_attach() returns an error), mana_probe() > calls mana_remove(), which tears down the device and sets > gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed > resume callback does not automatically unbind the driver. When the device > is eventually unbound, mana_remove() is invoked a second time. Without a > NULL check, it dereferences gc->dev with gc == NULL, causing a kernel > panic. Add an early return if gdma_context or driver_data is NULL so the > second invocation is harmless. > > > Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network > > Adapter (MANA)") > > The Fixes: tag points to ca9c54d2d6a5, which introduced mana_remove() > without NULL checks. However, the exploitable double invocation scenario > was actually introduced by commit 635096a86edb ("net: mana: Support > hibernation and kexec"), which added suspend/resume support and made > mana_probe() call mana_remove() on error. > > Should the Fixes: tag be: > > Fixes: 635096a86edb ("net: mana: Support hibernation and kexec") > > > diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c > > b/drivers/net/ethernet/microsoft/mana/mana_en.c > > index 9d095a6fb56c..2ab7c89e2fed 100644 > > --- a/drivers/net/ethernet/microsoft/mana/mana_en.c > > +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c > > @@ -3685,11 +3685,16 @@ void mana_remove(struct gdma_dev *gd, bool > > suspending) > > struct gdma_context *gc = gd->gdma_context; > > struct mana_context *ac = gd->driver_data; > > struct mana_port_context *apc; > > - struct device *dev = gc->dev; > > + struct device *dev; > > struct net_device *ndev; > > int err; > > int i; > > > > + if (!gc || !ac) > > + return; > > + > > + dev = gc->dev; > > + > > disable_work_sync(&ac->link_change_work); > > cancel_delayed_work_sync(&ac->gf_stats_work); Thankyou for the correction, Simon. I'll make this change in the next version.
- Vennela
