This is an AI-generated review of your patch. The human sending this email has considered the AI review valid, or at least plausible.
For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html --- net: mana: Guard mana_remove against double invocation If PM resume fails (e.g., mana_attach() returns an error), mana_probe() calls mana_remove(), which tears down the device and sets gd->gdma_context = NULL and gd->driver_data = NULL. However, a failed resume callback does not automatically unbind the driver. When the device is eventually unbound, mana_remove() is invoked a second time. Without a NULL check, it dereferences gc->dev with gc == NULL, causing a kernel panic. Add an early return if gdma_context or driver_data is NULL so the second invocation is harmless. > Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network > Adapter (MANA)") The Fixes: tag points to ca9c54d2d6a5, which introduced mana_remove() without NULL checks. However, the exploitable double invocation scenario was actually introduced by commit 635096a86edb ("net: mana: Support hibernation and kexec"), which added suspend/resume support and made mana_probe() call mana_remove() on error. Should the Fixes: tag be: Fixes: 635096a86edb ("net: mana: Support hibernation and kexec") > diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c > b/drivers/net/ethernet/microsoft/mana/mana_en.c > index 9d095a6fb56c..2ab7c89e2fed 100644 > --- a/drivers/net/ethernet/microsoft/mana/mana_en.c > +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c > @@ -3685,11 +3685,16 @@ void mana_remove(struct gdma_dev *gd, bool suspending) > struct gdma_context *gc = gd->gdma_context; > struct mana_context *ac = gd->driver_data; > struct mana_port_context *apc; > - struct device *dev = gc->dev; > + struct device *dev; > struct net_device *ndev; > int err; > int i; > > + if (!gc || !ac) > + return; > + > + dev = gc->dev; > + > disable_work_sync(&ac->link_change_work); > cancel_delayed_work_sync(&ac->gf_stats_work);
