mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
sunvnet: free pending tx buffers before clearing ring data
This patch moves the clearing of ring data in vnet_port_free_tx_bufs to after the freeing of pending buffers in the ring. Otherwise, this can result in dereferencing a NULL pointer. Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com> Signed-off-by: David L Stevens <david.stevens@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
971f49dee2
commit
07ac3e7099
1 changed files with 11 additions and 10 deletions
|
@ -1637,16 +1637,9 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
|
|||
int i;
|
||||
|
||||
dr = &port->vio.drings[VIO_DRIVER_TX_RING];
|
||||
if (dr->base) {
|
||||
ldc_free_exp_dring(port->vio.lp, dr->base,
|
||||
(dr->entry_size * dr->num_entries),
|
||||
dr->cookies, dr->ncookies);
|
||||
dr->base = NULL;
|
||||
dr->entry_size = 0;
|
||||
dr->num_entries = 0;
|
||||
dr->pending = 0;
|
||||
dr->ncookies = 0;
|
||||
}
|
||||
|
||||
if (dr->base == NULL)
|
||||
return;
|
||||
|
||||
for (i = 0; i < VNET_TX_RING_SIZE; i++) {
|
||||
struct vio_net_desc *d;
|
||||
|
@ -1666,6 +1659,14 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
|
|||
port->tx_bufs[i].skb = NULL;
|
||||
d->hdr.state = VIO_DESC_FREE;
|
||||
}
|
||||
ldc_free_exp_dring(port->vio.lp, dr->base,
|
||||
(dr->entry_size * dr->num_entries),
|
||||
dr->cookies, dr->ncookies);
|
||||
dr->base = NULL;
|
||||
dr->entry_size = 0;
|
||||
dr->num_entries = 0;
|
||||
dr->pending = 0;
|
||||
dr->ncookies = 0;
|
||||
}
|
||||
|
||||
static int vnet_port_alloc_tx_ring(struct vnet_port *port)
|
||||
|
|
Loading…
Reference in a new issue