mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 18:11:39 +00:00
bnxt_en: make bnxt_free_skbs() safe to call after bnxt_free_mem()
commit1affc01fdc
upstream. The call to bnxt_free_mem(..., false) in the bnxt_half_open_nic() error path will deallocate ring descriptor memory via bnxt_free_?x_rings(), but because irq_re_init is false, the ring info itself is not freed. To simplify error paths, deallocation functions have generally been written to be safe when called on unallocated memory. It should always be safe to call dev_close(), which calls bnxt_free_skbs() a second time, even in this semi- allocated ring state. Calling bnxt_free_skbs() a second time with the rings already freed will cause NULL pointer dereference. Fix it by checking the rings are valid before proceeding in bnxt_free_tx_skbs() and bnxt_free_one_rx_ring_skbs(). Fixes:975bc99a4a
("bnxt_en: Refactor bnxt_free_rx_skbs().") Signed-off-by: Edwin Peer <edwin.peer@broadcom.com> Signed-off-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
49eff4ab7d
commit
0511d099db
1 changed files with 13 additions and 0 deletions
|
@ -2591,6 +2591,9 @@ static void bnxt_free_tx_skbs(struct bnxt *bp)
|
|||
struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];
|
||||
int j;
|
||||
|
||||
if (!txr->tx_buf_ring)
|
||||
continue;
|
||||
|
||||
for (j = 0; j < max_idx;) {
|
||||
struct bnxt_sw_tx_bd *tx_buf = &txr->tx_buf_ring[j];
|
||||
struct sk_buff *skb;
|
||||
|
@ -2675,6 +2678,9 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
|
|||
}
|
||||
|
||||
skip_rx_tpa_free:
|
||||
if (!rxr->rx_buf_ring)
|
||||
goto skip_rx_buf_free;
|
||||
|
||||
for (i = 0; i < max_idx; i++) {
|
||||
struct bnxt_sw_rx_bd *rx_buf = &rxr->rx_buf_ring[i];
|
||||
dma_addr_t mapping = rx_buf->mapping;
|
||||
|
@ -2697,6 +2703,11 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
|
|||
kfree(data);
|
||||
}
|
||||
}
|
||||
|
||||
skip_rx_buf_free:
|
||||
if (!rxr->rx_agg_ring)
|
||||
goto skip_rx_agg_free;
|
||||
|
||||
for (i = 0; i < max_agg_idx; i++) {
|
||||
struct bnxt_sw_rx_agg_bd *rx_agg_buf = &rxr->rx_agg_ring[i];
|
||||
struct page *page = rx_agg_buf->page;
|
||||
|
@ -2713,6 +2724,8 @@ static void bnxt_free_one_rx_ring_skbs(struct bnxt *bp, int ring_nr)
|
|||
|
||||
__free_page(page);
|
||||
}
|
||||
|
||||
skip_rx_agg_free:
|
||||
if (rxr->rx_page) {
|
||||
__free_page(rxr->rx_page);
|
||||
rxr->rx_page = NULL;
|
||||
|
|
Loading…
Reference in a new issue