Re: [PATCH v2] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[Vadim Fedorenko]

On 17/08/2026 16:13, Jiangshan Yi wrote:
> bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
> If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
> which dereferences bp->fp in a loop bounded by the non-zero
> bp->fp_array_size, causing a NULL pointer dereference.
>
> Move the bp->fp_array_size assignment to after bp->fp is set so that
> the loop in bnx2x_free_mem_bp() naturally becomes a no-op when bp->fp
> is NULL, since bp is zero-initialized and fp_array_size remains 0.
>
> Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan@xxxxxxxxxx
> Suggested-by: Vadim Fedorenko <vadim.fedorenko@xxxxxxxxx>

No need for this tag, it's not used for code improvements

> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>

Please, review netdev contribution rules at
https://docs.kernel.org/process/maintainer-netdev.html

Especially patch formatting and 24h cool-down period