Bobby Eshleman 593dfd40a9 eth: fbnic: fix double-free of PCS on phylink creation failure ... fbnic_phylink_create() stores the newly allocated PCS in fbn->pcs and then calls phylink_create(). When phylink_create() fails, the error path correctly destroys the PCS via xpcs_destroy_pcs(), but the caller, fbnic_netdev_alloc(), responds by invoking fbnic_netdev_free() which calls fbnic_phylink_destroy(). That function finds fbn->pcs non-NULL and calls xpcs_destroy_pcs() a second time on the already-freed object, triggering a refcount underflow use-after-free: [ 1.934973] fbnic 0000:01:00.0: Failed to create Phylink interface, err: -22 [ 1.935103] ------------[ cut here ]------------ [ 1.935179] refcount_t: underflow; use-after-free. [ 1.935252] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90, CPU#0: swapper/0/1 [ 1.935389] Modules linked in: [ 1.935484] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-virtme-04244-g1f5ffc672165-dirty #1 PREEMPT(lazy) [ 1.935661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 1.935826] RIP: 0010:refcount_warn_saturate+0x59/0x90 [ 1.935931] Code: 44 48 8d 3d 49 f9 a7 01 67 48 0f b9 3a e9 bf 1e 96 00 48 8d 3d 48 f9 a7 01 67 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 47 f9 a7 01 <67> 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 46 f9 a7 01 67 48 0f b9 3a [ 1.936274] RSP: 0000:ffffd0d440013c58 EFLAGS: 00010246 [ 1.936376] RAX: 0000000000000000 RBX: ffff8f39c188c278 RCX: 000000000000002b [ 1.936524] RDX: ffff8f39c004f000 RSI: 0000000000000003 RDI: ffffffff96abab00 [ 1.936692] RBP: ffff8f39c188c240 R08: ffffffff96988e88 R09: 00000000ffffdfff [ 1.936835] R10: ffffffff96878ea0 R11: 0000000000000187 R12: 0000000000000000 [ 1.936970] R13: ffff8f39c0cef0c8 R14: ffff8f39c1ac01c0 R15: 0000000000000000 [ 1.937114] FS: 0000000000000000(0000) GS:ffff8f3ba08b4000(0000) knlGS:0000000000000000 [ 1.937273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.937382] CR2: ffff8f3b3ffff000 CR3: 0000000172642001 CR4: 0000000000372ef0 [ 1.937540] Call Trace: [ 1.937619] <TASK> [ 1.937698] xpcs_destroy_pcs+0x25/0x40 [ 1.937783] fbnic_netdev_alloc+0x1e5/0x200 [ 1.937859] fbnic_probe+0x230/0x370 [ 1.937939] local_pci_probe+0x3e/0x90 [ 1.938013] pci_device_probe+0xbb/0x1e0 [ 1.938091] ? sysfs_do_create_link_sd+0x6d/0xe0 [ 1.938188] really_probe+0xc1/0x2b0 [ 1.938282] __driver_probe_device+0x73/0x120 [ 1.938371] driver_probe_device+0x1e/0xe0 [ 1.938466] __driver_attach+0x8d/0x190 [ 1.938560] ? __pfx___driver_attach+0x10/0x10 [ 1.938663] bus_for_each_dev+0x7b/0xd0 [ 1.938758] bus_add_driver+0xe8/0x210 [ 1.938854] driver_register+0x60/0x120 [ 1.938929] ? __pfx_fbnic_init_module+0x10/0x10 [ 1.939026] fbnic_init_module+0x25/0x60 [ 1.939109] do_one_initcall+0x49/0x220 [ 1.939202] ? rdinit_setup+0x20/0x40 [ 1.939304] kernel_init_freeable+0x1b0/0x310 [ 1.939449] ? __pfx_kernel_init+0x10/0x10 [ 1.939560] kernel_init+0x1a/0x1c0 [ 1.939640] ret_from_fork+0x1ed/0x240 [ 1.939730] ? __pfx_kernel_init+0x10/0x10 [ 1.939805] ret_from_fork_asm+0x1a/0x30 [ 1.939886] </TASK> [ 1.939927] ---[ end trace 0000000000000000 ]--- [ 1.940184] fbnic 0000:01:00.0: Netdev allocation failed Instead of calling fbnic_phylink_destroy(), the prior initialization of netdev should just be unrolled with free_netdev() and clearing fbd->netdev. Clearing fbd->netdev to NULL avoids UAF in init_failure_mode where callers guard by checking !fbd->netdev, such as fbnic_mdio_read_pmd(). These callers remain active even after a failed probe, so fdb->netdev still needs to be cleared. Fixes: d0fe7104c7 ("fbnic: Replace use of internal PCS w/ Designware XPCS") Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com> Link: https://patch.msgid.link/20260504-fbnic-pcs-fix-v2-1-de45192821d9@meta.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>		2026-05-07 12:34:42 +02:00
..
arcnet	…
bonding	bonding: 3ad: implement proper RCU rules for port->aggregator	2026-04-29 18:32:02 -07:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
dsa	net: dsa: mt7530: fix .get_stats64 sleeping in atomic context	2026-05-04 19:28:54 -07:00
ethernet	eth: fbnic: fix double-free of PCS on phylink creation failure	2026-05-07 12:34:42 +02:00
fddi	…
fjes	…
hyperv	…
ieee802154	…
ipa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2026-04-14 12:04:00 -07:00
ipvlan	Networking changes for 7.1.	2026-04-14 18:36:10 -07:00
mctp	net: mctp i2c: check length before marking flow active	2026-04-28 13:11:53 +02:00
mdio	net: mdio: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP	2026-04-16 19:04:58 -07:00
netdevsim	netdevsim: psp: rcu protect psp_dev reference	2026-05-06 17:39:20 -07:00
ovpn	ovpn: ensure packet delivery happens with BH disabled	2026-05-05 00:31:06 +02:00
pcs	…
phy	net: phy: micrel: fix LAN8814 QSGMII soft reset	2026-04-30 16:49:23 -07:00
plip	…
ppp	pppoe: drop PFC frames	2026-04-20 11:35:17 -07:00
pse-pd	net: pse-pd: fix out-of-bounds bitmap access in pse_isr() on 32-bit	2026-04-16 19:25:32 -07:00
slip	slip: bound decode() reads against the compressed packet length	2026-04-21 10:18:18 +02:00
team	net: team: Add new tx_enabled team port option	2026-04-13 15:09:49 +02:00
thunderbolt	…
usb	net: usb: asix: ax88772: re-add usbnet_link_change() in phylink callbacks	2026-05-04 19:04:15 -07:00
vmxnet3	…
vxlan	…
wan	net: wan: fsl_ucc_hdlc: fix ucc_hdlc_remove	2026-05-02 10:14:06 -07:00
wireguard	wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit	2026-04-14 11:48:04 -07:00
wireless	ath.git update for v7.1-rc3	2026-05-05 17:52:48 +02:00
wwan	net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler	2026-05-05 19:05:11 -07:00
xen-netback	…
Kconfig	caif: remove CAIF NETWORK LAYER	2026-04-23 10:23:44 -07:00
LICENSE.SRC	…
Makefile	net: remove ax25 and amateur radio (hamradio) subsystem	2026-04-23 10:24:02 -07:00
Space.c	drivers: net: 8390: wd80x3: Remove this driver	2026-04-23 15:57:10 -07:00
amt.c	…
bareudp.c	bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()	2026-04-28 18:16:53 -07:00
dummy.c	dummy: convert to ndo_set_rx_mode_async	2026-04-21 12:50:25 +02:00
eql.c	…
geneve.c	…
gtp.c	gtp: disable BH before calling udp_tunnel_xmit_skb()	2026-04-20 11:46:24 -07:00
ifb.c	…
loopback.c	…
macsec.c	macsec: Support VLAN-filtering lower devices	2026-04-09 19:38:42 -07:00
macvlan.c	macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF	2026-04-16 12:17:11 +02:00
macvtap.c	kernfs: pass struct ns_common instead of const void * for namespace tags	2026-04-09 14:36:52 +02:00
mdio.c	…
mhi_net.c	…
mii.c	…
net_failover.c	…
netconsole.c	netconsole: restore userdatum value on update_userdata() failure	2026-04-28 18:28:12 -07:00
netkit.c	netkit: convert to ndo_set_rx_mode_async	2026-04-21 12:50:25 +02:00
nlmon.c	…
ntb_netdev.c	…
pfcp.c	…
rionet.c	…
sungem_phy.c	…
tap.c	…
tun.c	net: change sk_filter_reason() to return the reason by value	2026-04-12 14:30:25 -07:00
tun_vnet.h	…
veth.c	…
virtio_net.c	virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET	2026-04-23 09:35:53 -07:00
vrf.c	vrf: Fix a potential NPD when removing a port from a VRF	2026-04-27 17:43:22 -07:00
vsockmon.c	…
xen-netfront.c	…