Re: [PATCH net] net: alacritech: fix dma_free_coherent() in error path

[Paolo Abeni]

On 10/6/26 16:09, Thomas Fourier wrote:
> In slic_init_stat_queue(), a series of coherent buffers is allocated
> with the length size. The size is then stored in stq->mem_size for
> normal deallocation. However, in the error path, stq->mem_size is also
> used but is not initialized. This error may leave the freed buffers
> mapped, leaking a resource and allowing the device to access freed
> memory.
>
> Change the length in error path to size.
>
> Fixes: 60c140df15db ("net: ethernet: slicoss: add slicoss gigabit ethernet driver")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Thomas Fourier <fourier.thomas@xxxxxxxxx>

FTR, bad things in NIC error path for old drivers is the exact
prototype of things we are actively redirecting to net-next at
this point of the cycle. Also stripping the stable tag.

/P