From 087827628ad3d9cab31365114e8b4d6d153dfa36 Mon Sep 17 00:00:00 2001 From: Sang-Hoon Choi Date: Tue, 22 Sep 2026 03:49:28 +0900 Subject: [PATCH] hinic3: handle auxiliary device ID allocation failure hinic3_init_hwdev() stores the result of hinic3_adev_idx_alloc() in hwdev->dev_id without checking for an error. If ID allocation fails but the remaining initialization succeeds, hinic3_add_one_adev() uses the negative error code as the auxiliary device ID instead of a reserved ID. Return the allocation error before initializing the hardware. Add an unwind label that clears pci_adapter->hwdev and frees the allocation without attempting to release an ID that was never allocated. Cc: stable+noautosel@kernel.org # untested fix to unlikely driver error path Reported-by: Changyul Lee Signed-off-by: Sang-Hoon Choi Link: https://patch.msgid.link/179001656835.91284.3719235813225229273.idr-bug-81@gmail.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/huawei/hinic3/hinic3_hwdev.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_hwdev.c b/drivers/net/ethernet/huawei/hinic3/hinic3_hwdev.c index f44b3064ab2e..830bf9aadbf5 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_hwdev.c +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_hwdev.c @@ -545,6 +545,10 @@ int hinic3_init_hwdev(struct pci_dev *pdev) hwdev->dev = &pci_adapter->pdev->dev; hwdev->func_state = 0; hwdev->dev_id = hinic3_adev_idx_alloc(); + if (hwdev->dev_id < 0) { + err = hwdev->dev_id; + goto err_free_hwdev_no_id; + } spin_lock_init(&hwdev->channel_lock); err = hinic3_init_hwif(hwdev); @@ -602,8 +606,9 @@ err_destroy_workqueue: err_free_hwif: hinic3_free_hwif(hwdev); err_free_hwdev: - pci_adapter->hwdev = NULL; hinic3_adev_idx_free(hwdev->dev_id); +err_free_hwdev_no_id: + pci_adapter->hwdev = NULL; kfree(hwdev); return err;