Re: [PATCH] bnx2x: fix double free in bnx2x_init_firmware() error path

[Simon Horman]

On Sat, Aug 15, 2026 at 08:21:49PM +0800, Jiangshan Yi wrote:
> bnx2x_init_firmware() frees bp->init_ops, bp->init_data and
> bp->init_ops_offsets in its error path without setting them to NULL.
> The cleanup function bnx2x_release_firmware() frees the same three
> pointers unconditionally, so if init_firmware fails and
> release_firmware is later called (e.g. from __bnx2x_remove or through
> the function state machine), all three are freed a second time.
> 
> Set each pointer to NULL after kfree() in the error path so that the
> subsequent kfree(NULL) in bnx2x_release_firmware() is a safe no-op.
> 
> Fixes: 94a78b79cb5f ("bnx2x: Separated FW from the source.")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jiangshan Yi <yijiangshan@xxxxxxxxxx>

Reviewed-by: Simon Horman <horms@xxxxxxxxxx>