From 05b5019b01fb9443b09ae4ed34af1135a80a84c8 Mon Sep 17 00:00:00 2001 From: Thomas Fourier Date: Tue, 6 Oct 2026 16:09:09 +0200 Subject: [PATCH] net: alacritech: fix dma_free_coherent() in error path In slic_init_stat_queue(), a series of coherent buffers is allocated with the length size. The size is then stored in stq->mem_size for normal deallocation. However, in the error path, stq->mem_size is also used but is not initialized. This error may leave the freed buffers mapped, leaking a resource and allowing the device to access freed memory. Change the length in error path to size. Fixes: 60c140df15db ("net: ethernet: slicoss: add slicoss gigabit ethernet driver") Signed-off-by: Thomas Fourier Reviewed-by: Daniel Machon Link: https://patch.msgid.link/20261006140912.50828-2-fourier.thomas@gmail.com Signed-off-by: Paolo Abeni --- drivers/net/ethernet/alacritech/slicoss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/alacritech/slicoss.c b/drivers/net/ethernet/alacritech/slicoss.c index 14b74c09233e..9456ffd5067e 100644 --- a/drivers/net/ethernet/alacritech/slicoss.c +++ b/drivers/net/ethernet/alacritech/slicoss.c @@ -814,7 +814,7 @@ static int slic_init_stat_queue(struct slic_device *sdev) free_descs: while (i--) { - dma_free_coherent(&sdev->pdev->dev, stq->mem_size, + dma_free_coherent(&sdev->pdev->dev, size, stq->descs[i] - stq->addr_offset[i], stq->paddr[i] - stq->addr_offset[i]); }