)]}'
{
  "commit": "593dfd40a94ca0ab20297ea4629d94268deed0ed",
  "tree": "43fe426f1d05fcdbec0353de83d9c24059304755",
  "parents": [
    "b266bacba796ff5c4dcd2ae2fc08aacf7ab39153"
  ],
  "author": {
    "name": "Bobby Eshleman",
    "email": "bobbyeshleman@meta.com",
    "time": "Mon May 04 18:42:11 2026 -0700"
  },
  "committer": {
    "name": "Paolo Abeni",
    "email": "pabeni@redhat.com",
    "time": "Thu May 07 12:34:42 2026 +0200"
  },
  "message": "eth: fbnic: fix double-free of PCS on phylink creation failure\n\nfbnic_phylink_create() stores the newly allocated PCS in fbn-\u003epcs and\nthen calls phylink_create(). When phylink_create() fails, the error path\ncorrectly destroys the PCS via xpcs_destroy_pcs(), but the caller,\nfbnic_netdev_alloc(), responds by invoking fbnic_netdev_free() which\ncalls fbnic_phylink_destroy(). That function finds fbn-\u003epcs non-NULL and\ncalls xpcs_destroy_pcs() a second time on the already-freed object,\ntriggering a refcount underflow use-after-free:\n\n[   1.934973] fbnic 0000:01:00.0: Failed to create Phylink interface, err: -22\n[   1.935103] ------------[ cut here ]------------\n[   1.935179] refcount_t: underflow; use-after-free.\n[   1.935252] WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x59/0x90, CPU#0: swapper/0/1\n[   1.935389] Modules linked in:\n[   1.935484] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 7.0.0-virtme-04244-g1f5ffc672165-dirty #1 PREEMPT(lazy)\n[   1.935661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014\n[   1.935826] RIP: 0010:refcount_warn_saturate+0x59/0x90\n[   1.935931] Code: 44 48 8d 3d 49 f9 a7 01 67 48 0f b9 3a e9 bf 1e 96 00 48 8d 3d 48 f9 a7 01 67 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 47 f9 a7 01 \u003c67\u003e 48 0f b9 3a c3 cc cc cc cc 48 8d 3d 46 f9 a7 01 67 48 0f b9 3a\n[   1.936274] RSP: 0000:ffffd0d440013c58 EFLAGS: 00010246\n[   1.936376] RAX: 0000000000000000 RBX: ffff8f39c188c278 RCX: 000000000000002b\n[   1.936524] RDX: ffff8f39c004f000 RSI: 0000000000000003 RDI: ffffffff96abab00\n[   1.936692] RBP: ffff8f39c188c240 R08: ffffffff96988e88 R09: 00000000ffffdfff\n[   1.936835] R10: ffffffff96878ea0 R11: 0000000000000187 R12: 0000000000000000\n[   1.936970] R13: ffff8f39c0cef0c8 R14: ffff8f39c1ac01c0 R15: 0000000000000000\n[   1.937114] FS:  0000000000000000(0000) GS:ffff8f3ba08b4000(0000) knlGS:0000000000000000\n[   1.937273] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   1.937382] CR2: ffff8f3b3ffff000 CR3: 0000000172642001 CR4: 0000000000372ef0\n[   1.937540] Call Trace:\n[   1.937619]  \u003cTASK\u003e\n[   1.937698]  xpcs_destroy_pcs+0x25/0x40\n[   1.937783]  fbnic_netdev_alloc+0x1e5/0x200\n[   1.937859]  fbnic_probe+0x230/0x370\n[   1.937939]  local_pci_probe+0x3e/0x90\n[   1.938013]  pci_device_probe+0xbb/0x1e0\n[   1.938091]  ? sysfs_do_create_link_sd+0x6d/0xe0\n[   1.938188]  really_probe+0xc1/0x2b0\n[   1.938282]  __driver_probe_device+0x73/0x120\n[   1.938371]  driver_probe_device+0x1e/0xe0\n[   1.938466]  __driver_attach+0x8d/0x190\n[   1.938560]  ? __pfx___driver_attach+0x10/0x10\n[   1.938663]  bus_for_each_dev+0x7b/0xd0\n[   1.938758]  bus_add_driver+0xe8/0x210\n[   1.938854]  driver_register+0x60/0x120\n[   1.938929]  ? __pfx_fbnic_init_module+0x10/0x10\n[   1.939026]  fbnic_init_module+0x25/0x60\n[   1.939109]  do_one_initcall+0x49/0x220\n[   1.939202]  ? rdinit_setup+0x20/0x40\n[   1.939304]  kernel_init_freeable+0x1b0/0x310\n[   1.939449]  ? __pfx_kernel_init+0x10/0x10\n[   1.939560]  kernel_init+0x1a/0x1c0\n[   1.939640]  ret_from_fork+0x1ed/0x240\n[   1.939730]  ? __pfx_kernel_init+0x10/0x10\n[   1.939805]  ret_from_fork_asm+0x1a/0x30\n[   1.939886]  \u003c/TASK\u003e\n[   1.939927] ---[ end trace 0000000000000000 ]---\n[   1.940184] fbnic 0000:01:00.0: Netdev allocation failed\n\nInstead of calling fbnic_phylink_destroy(), the prior initialization of\nnetdev should just be unrolled with free_netdev() and clearing\nfbd-\u003enetdev.\n\nClearing fbd-\u003enetdev to NULL avoids UAF in init_failure_mode where\ncallers guard by checking !fbd-\u003enetdev, such as fbnic_mdio_read_pmd().\nThese callers remain active even after a failed probe, so fdb-\u003enetdev\nstill needs to be cleared.\n\nFixes: d0fe7104c795 (\"fbnic: Replace use of internal PCS w/ Designware XPCS\")\nSigned-off-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260504-fbnic-pcs-fix-v2-1-de45192821d9@meta.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c406a3b56b37fd8c206638db20835020f234fdd3",
      "old_mode": 33188,
      "old_path": "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c",
      "new_id": "4dea2bb58d2fcae73d50562c8f6ad81fbe152130",
      "new_mode": 33188,
      "new_path": "drivers/net/ethernet/meta/fbnic/fbnic_netdev.c"
    }
  ]
}