From patchwork Wed Apr 11 15:50:18 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Chan X-Patchwork-Id: 897251 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=quarantine dis=none) header.from=broadcom.com Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=broadcom.com header.i=@broadcom.com header.b="Y3dOfP95"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40LpR91G8xz9s0x for ; Thu, 12 Apr 2018 01:50:45 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753751AbeDKPum (ORCPT ); Wed, 11 Apr 2018 11:50:42 -0400 Received: from mail-pg0-f66.google.com ([74.125.83.66]:37933 "EHLO mail-pg0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753463AbeDKPul (ORCPT ); Wed, 11 Apr 2018 11:50:41 -0400 Received: by mail-pg0-f66.google.com with SMTP id f4so943124pgs.5 for ; Wed, 11 Apr 2018 08:50:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Z3wwB6oB00LPWP/LrvbbPnGixU/vp8jHPzvtho7bjCo=; b=Y3dOfP95djo50uNnd4RGqWf8MoIKDMXA5ug79IhD3Y4UDImDGEFE4LDL/d3OPLXlQq n+WH0aYWvAzMDVkaqB8c0hAjWGjjJJp8TxJthqlHwX3jv84Uw5HGmnIyaSUhTUKIPm3W OoOJJcbuvegzeAiRyLfFG3l/PaQ5T99qPBB58= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Z3wwB6oB00LPWP/LrvbbPnGixU/vp8jHPzvtho7bjCo=; b=QBEZYFQmNzcVHExA5PorQoIdb2PJ45SJrDC0G4qK0u2XKI88LyTN5u3mds67MOgjgr MOOGST75X9xGWRlurlaZdyMX8ve45zqQPh4oKlIzHg/YXhzjFgmxgmiy2pxsRA7yO8aq d0fUzXiAsHOsZrPY1Y6irhcA7pSXNvyDz43gptq1MygvVBC3JZdq98hvatAsebVR+sbV LSQ6bcogJBrLgo4WYzTh+KntD4ILrSI47xCfN9VqV3lZB5v4uh70zKDnDSSEEDRIWkuY MGivrQBRh0OgcqfnVaVVzXLWsAXc9tT5sjeOnnvifEjO9fFy8p0a7GGvTw0eWsamNR2V zQMw== X-Gm-Message-State: ALQs6tBM2XGxIRerns/4Dq7fIthaiaPvo6c05aF1MSXPu9lx0DLIGeVN MfqexBvHfMZO5Z4ZRwKKBfWklA== X-Google-Smtp-Source: AIpwx48/N5czF9Rj5MPTVmibWmCbVLJ7Nygs3ero5XLGOlaGApEk5wGsSZHt+imwhJopzkG3kWg2Fg== X-Received: by 10.99.117.84 with SMTP id f20mr3846630pgn.188.1523461840599; Wed, 11 Apr 2018 08:50:40 -0700 (PDT) Received: from localhost.dhcp.broadcom.net ([192.19.223.250]) by smtp.gmail.com with ESMTPSA id b3sm3380872pfi.54.2018.04.11.08.50.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 11 Apr 2018 08:50:40 -0700 (PDT) From: Michael Chan To: davem@davemloft.net Cc: netdev@vger.kernel.org Subject: [PATCH net v2 6/6] bnxt_en: Fix NULL pointer dereference at bnxt_free_irq(). Date: Wed, 11 Apr 2018 11:50:18 -0400 Message-Id: <1523461818-15774-7-git-send-email-michael.chan@broadcom.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1523461818-15774-1-git-send-email-michael.chan@broadcom.com> References: <1523461818-15774-1-git-send-email-michael.chan@broadcom.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org When open fails during ethtool -L ring change, for example, the driver may crash at bnxt_free_irq() because bp->bnapi is NULL. If we fail to allocate all the new rings, bnxt_open_nic() will free all the memory including bp->bnapi. Subsequent call to bnxt_close_nic() will try to dereference bp->bnapi in bnxt_free_irq(). Fix it by checking for !bp->bnapi in bnxt_free_irq(). Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 9cb8b4b..f83769d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp) free_irq_cpu_rmap(bp->dev->rx_cpu_rmap); bp->dev->rx_cpu_rmap = NULL; #endif - if (!bp->irq_tbl) + if (!bp->irq_tbl || !bp->bnapi) return; for (i = 0; i < bp->cp_nr_rings; i++) {