Commit a0721c099b for qemu.org

commit a0721c099b71f7bdfafa2675daee331d884163d2
Author: Peter Maydell <peter.maydell@linaro.org>
Date:   Mon Mar 30 16:18:06 2026 +0100

    hw/net/rocker: Avoid double-free of l2_flood.group_ids

    In of_dpa_cmd_add_l2_flood(), we allocate memory for the
    group->l2_flood.group_ids array, freeing any previous array.
    However, in the error-exit path we free the group_ids memory but do
    not clear the pointer to NULL.  This means that if the guest causes
    us to take the error-exit path and then later call the function
    again, we will try again to free the memory we already freed.

    Fix this by clearing the group_ids pointer in the error exit
    path, so we maintain the invariant of "either it points at
    allocated memory, or it is NULL" (both being valid to g_free()).

    Cc: qemu-stable@nongnu.org
    Fixes: dc488f88806 ("rocker: add new rocker switch device")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3253
    Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
    Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
    Message-id: 20260324193530.375628-1-peter.maydell@linaro.org

diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
index 814f19afc5..3190a0e75c 100644
--- a/hw/net/rocker/rocker_of_dpa.c
+++ b/hw/net/rocker/rocker_of_dpa.c
@@ -2059,6 +2059,7 @@ static int of_dpa_cmd_add_l2_flood(OfDpa *of_dpa, OfDpaGroup *group,
 err_out:
     group->l2_flood.group_count = 0;
     g_free(group->l2_flood.group_ids);
+    group->l2_flood.group_ids = NULL;
     g_free(tlvs);

     return err;