ice: ice_adapter: release xa entry on adapter allocation failure

When ice_adapter_new() fails, the reserved XArray entry created by
xa_insert() is not released. This causes subsequent insertions at
the same index to return -EBUSY, potentially leading to
NULL pointer dereferences.

Reorder the operations as suggested by Przemek Kitszel:
1. Check if adapter already exists (xa_load)
2. Reserve the XArray slot (xa_reserve)
3. Allocate the adapter (ice_adapter_new)
4. Store the adapter (xa_store)

Fixes: 0f0023c649c7 ("ice: do not init struct ice_adapter more times than needed")
Suggested-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251001115336.1707-1-vulab@iscas.ac.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/intel/ice/ice_adapter.c b/drivers/net/ethernet/intel/ice/ice_adapter.c
index b53561c347082f725f2a9c10b0c262ceadbe815c..0a8a48cd4bce6f1a11c3213ce16a1689118d646f 100644 (file)
--- a/drivers/net/ethernet/intel/ice/ice_adapter.c
+++ b/drivers/net/ethernet/intel/ice/ice_adapter.c
@@ -99,19 +99,21 @@ struct ice_adapter *ice_adapter_get(struct pci_dev *pdev)
 
        index = ice_adapter_xa_index(pdev);
        scoped_guard(mutex, &ice_adapters_mutex) {
-               err = xa_insert(&ice_adapters, index, NULL, GFP_KERNEL);
-               if (err == -EBUSY) {
-                       adapter = xa_load(&ice_adapters, index);
+               adapter = xa_load(&ice_adapters, index);
+               if (adapter) {
                        refcount_inc(&adapter->refcount);
                        WARN_ON_ONCE(adapter->index != ice_adapter_index(pdev));
                        return adapter;
                }
+               err = xa_reserve(&ice_adapters, index, GFP_KERNEL);
                if (err)
                        return ERR_PTR(err);
 
                adapter = ice_adapter_new(pdev);
-               if (!adapter)
+               if (!adapter) {
+                       xa_release(&ice_adapters, index);
                        return ERR_PTR(-ENOMEM);
+               }
                xa_store(&ice_adapters, index, adapter, GFP_KERNEL);
        }
        return adapter;