RE: [PATCH net v5] net: e1000: fix warning in iounmap on probe failure

[Loktionov, Aleksandr]

> -----Original Message-----
> From: Svyatoslav Nikolenko <nsvatoslav515@xxxxxxxxx>
> Sent: Monday, September 28, 2026 2:38 PM
> To: Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel,
> Przemyslaw <przemyslaw.kitszel@xxxxxxxxx>; andrew+netdev@xxxxxxx;
> davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx; kuba@xxxxxxxxxx;
> pabeni@xxxxxxxxxx
> Cc: intel-wired-lan@xxxxxxxxxxxxxxxx; netdev@xxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; Svyatoslav Nikolenko
> <nsvatoslav515@xxxxxxxxx>;
> syzbot+ca1ef9e2e234b8d3599b@xxxxxxxxxxxxxxxxxxxxxxxxx;
> stable@xxxxxxxxxxxxxxx
> Subject: [PATCH net v5] net: e1000: fix warning in iounmap on probe
> failure
> 
> In e1000_probe(), the error unwinding path at err_sw_init
> unconditionally calls iounmap(hw->ce4100_gbe_mdio_base_virt). On non-
> CE4100 hardware,
> hw->ce4100_gbe_mdio_base_virt remains NULL.
> Passing NULL to iounmap() triggers a WARN_ON_ONCE on x86
> architectures.
> Furthermore, on CE4100 hardware, if probe fails before or during MDIO
> mapping, ce4100_gbe_mdio_base_virt is also NULL.
> 
> Fix this by adding a NULL pointer check before calling iounmap() on
> hw->ce4100_gbe_mdio_base_virt. iounmap(hw->hw_addr) remains
> hw->unconditional
> because every code path reaching err_sw_init occurs after hw->hw_addr
> has been successfully mapped.
> 
> Reported-by: syzbot+ca1ef9e2e234b8d3599b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=ca1ef9e2e234b8d3599b
> Fixes: 13acde8fffc0 ("e1000: cleanup CE4100 MDIO registers access")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Svyatoslav Nikolenko <nsvatoslav515@xxxxxxxxx>
> ---
> v5:
>   - Updated commit message and changelog to accurately describe the
> NULL pointer
>     check implemented in the diff.
>   - Fixed subject string in the Fixes: tag to match commit
> 13acde8fffc0.
> v4:
>   - Actually include the code changes (v3 was sent un-staged by
> mistake)
> v3:
>   - Switched from pointer null-checks to checking hw->mac_type ==
> e1000_ce4100
>   - Removed redundant check for hw->hw_addr since it cannot be NULL
> here
>   - Added missing Cc: stable tag and Closes tag
> v2:
>   - Expanded commit message to answer reviewer questions (reproduction
> details)
>   - Added appropriate Fixes tags
> 
>  drivers/net/ethernet/intel/e1000/e1000_main.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c
> b/drivers/net/ethernet/intel/e1000/e1000_main.c
> index d7f5c6f16142..d7e279b739b8 100644
> --- a/drivers/net/ethernet/intel/e1000/e1000_main.c
> +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
> @@ -1227,7 +1227,8 @@ static int e1000_probe(struct pci_dev *pdev,
> const struct pci_device_id *ent)
>  	kfree(adapter->rx_ring);
>  err_dma:
>  err_sw_init:
> -	iounmap(hw->ce4100_gbe_mdio_base_virt);
> +	if (hw->ce4100_gbe_mdio_base_virt)
> +		iounmap(hw->ce4100_gbe_mdio_base_virt);
>  	iounmap(hw->hw_addr);
>  err_ioremap:
>  	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter-
> >flags);
> --
> 2.47.3

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@xxxxxxxxx>