mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
mlx4_core: Fix possible bad free in mlx4_buf_free()
When mlx4_buf_free() is called from the error path of mlx4_buf_alloc(), it may be passed a buffer structure that does not have all pages filled in. Add a check for NULL to mlx4_buf_free() so we avoid passing NULL to dma_free_coherent() (which will crash). Signed-off-by: Ali Ayoub <ali@mellanox.co.il> Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
parent
9418d5dc9b
commit
3bba11e5c4
1 changed files with 4 additions and 3 deletions
|
@ -171,6 +171,7 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf)
|
|||
buf->u.direct.map);
|
||||
else {
|
||||
for (i = 0; i < buf->nbufs; ++i)
|
||||
if (buf->u.page_list[i].buf)
|
||||
dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
|
||||
buf->u.page_list[i].buf,
|
||||
buf->u.page_list[i].map);
|
||||
|
|
Loading…
Reference in a new issue