git: fe99b555c8ad - stable/15 - gve: fix double free on ring allocation failure

The branch stable/15 has been updated by markj:

URL: https://cgit.FreeBSD.org/src/commit/?id=fe99b555c8adb2c9d93df36c6b98822f25f7794a

commit fe99b555c8adb2c9d93df36c6b98822f25f7794a
Author:     Jasper Tran O'Leary <jtranoleary@google.com>
AuthorDate: 2026-10-07 13:29:31 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2026-10-22 15:45:42 +0000

    gve: fix double free on ring allocation failure
    
    When gve_alloc_rings fails (such as when failing to acquire MSI-X
    vectors or during partial ring allocation), ring cleanup can be
    executed multiple times across nested error paths (e.g. within
    gve_alloc_rings abort and gve_attach abort).
    
    Because gve_free_counters invoked counter_u64_free without nullifying
    the pointer in the stats array, repeated invocation caused a double-free
    panic when freeing the same counter references.
    
    Check for non-NULL before freeing and nullify each counter pointer
    upon release in gve_free_counters.
    
    Signed-off-by: Jasper Tran O'Leary <jtranoleary@google.com>
    
    Reviewed by:    adrian, markj
    MFC after:      2 weeks
    Differential Revision:  https://reviews.freebsd.org/D60386
    
    (cherry picked from commit 67f85bf4b3f1156f2300fb6414f6bb0ca446c436)
---
 sys/dev/gve/gve_utils.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/sys/dev/gve/gve_utils.c b/sys/dev/gve/gve_utils.c
index 707b8f039d88..498ffb305876 100644
--- a/sys/dev/gve/gve_utils.c
+++ b/sys/dev/gve/gve_utils.c
@@ -69,8 +69,12 @@ gve_free_counters(counter_u64_t *stat, int num_stats)
 {
 	int i;
 
-	for (i = 0; i < num_stats; i++)
-		counter_u64_free(stat[i]);
+	for (i = 0; i < num_stats; i++) {
+		if (stat[i] != NULL) {
+			counter_u64_free(stat[i]);
+			stat[i] = NULL;
+		}
+	}
 }
 
 /* Currently assumes a single segment. */