Re: [PATCH v2 2/4] can: gs_usb: gs_usb_probe(): init netdev completely before register_candev()

[Marc Kleine-Budde]

On 27.10.2026 09:40:52, netdev-bot+sashiko@xxxxxxxxxx wrote:
> [Severity: Critical]
> Both cleanup loops use dev, and dev still points at parent->canch[cur],
> the channel whose register_candev() just failed. Should these use
> parent->canch[i], like the gs_make_candev() failure loop earlier in
> gs_usb_probe()?
>
> As written, the first loop calls gs_destroy_candev() cur times on
> canch[cur], which was never registered. unregister_candev() on a
> NETREG_UNINITIALIZED netdev hits the WARN_ON(1) in
> unregister_netdevice_many_notify(). free_netdev() then frees it
> immediately:
>
> net/core/dev.c:free_netdev() {
>     ...
> 	if (dev->reg_state == NETREG_UNINITIALIZED ||
> 	    dev->reg_state == NETREG_DUMMY) {
> 		kvfree(dev);
>     ...
> }
>
> So when cur >= 2, does each later pass touch freed memory and then free
> it again?

Valid issue, will fix.

pw-bot: cr

regards,
Marc

-- 
Pengutronix e.K.                 | Marc Kleine-Budde          |
Embedded Linux                   | https://www.pengutronix.de |
Vertretung Nürnberg              | Phone: +49-5121-206917-129 |
Amtsgericht Hildesheim, HRA 2686 | Fax:   +49-5121-206917-9   |

Attachment: signature.asc
Description: PGP signature