All of lore.kernel.org
 help / color / mirror / Atom feed
From: Michael Chan <michael.chan@broadcom.com>
To: davem@davemloft.net
Cc: netdev@vger.kernel.org
Subject: [PATCH net v2 6/6] bnxt_en: Fix NULL pointer dereference at bnxt_free_irq().
Date: Wed, 11 Apr 2018 11:50:18 -0400	[thread overview]
Message-ID: <1523461818-15774-7-git-send-email-michael.chan@broadcom.com> (raw)
In-Reply-To: <1523461818-15774-1-git-send-email-michael.chan@broadcom.com>

When open fails during ethtool -L ring change, for example, the driver
may crash at bnxt_free_irq() because bp->bnapi is NULL.

If we fail to allocate all the new rings, bnxt_open_nic() will free
all the memory including bp->bnapi.  Subsequent call to bnxt_close_nic()
will try to dereference bp->bnapi in bnxt_free_irq().

Fix it by checking for !bp->bnapi in bnxt_free_irq().

Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 9cb8b4b..f83769d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp)
 	free_irq_cpu_rmap(bp->dev->rx_cpu_rmap);
 	bp->dev->rx_cpu_rmap = NULL;
 #endif
-	if (!bp->irq_tbl)
+	if (!bp->irq_tbl || !bp->bnapi)
 		return;
 
 	for (i = 0; i < bp->cp_nr_rings; i++) {
-- 
1.8.3.1

  parent reply	other threads:[~2018-04-11 15:50 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-04-11 15:50 [PATCH net v2 0/6] bnxt_en: Fixes for net Michael Chan
2018-04-11 15:50 ` [PATCH net v2 1/6] bnxt_en: Fix ethtool -x crash when device is down Michael Chan
2018-04-11 15:50 ` [PATCH net v2 2/6] bnxt_en: do not allow wildcard matches for L2 flows Michael Chan
2018-04-11 18:43   ` Jakub Kicinski
2018-04-11 20:21     ` Michael Chan
2018-04-11 20:31     ` Andy Gospodarek
2018-04-11 20:41       ` Michael Chan
2018-04-11 20:50         ` Andy Gospodarek
2018-04-11 20:55           ` Michael Chan
2018-04-11 21:19             ` Jakub Kicinski
2018-04-11 15:50 ` [PATCH net v2 3/6] bnxt_en: Ignore src port field in decap filter nodes Michael Chan
2018-04-11 15:50 ` [PATCH net v2 4/6] bnxt_en: Support max-mtu with VF-reps Michael Chan
2018-04-11 15:50 ` [PATCH net v2 5/6] bnxt_en: Need to include RDMA rings in bnxt_check_rings() Michael Chan
2018-04-11 15:50 ` Michael Chan [this message]
2018-04-11 18:42 ` [PATCH net v2 0/6] bnxt_en: Fixes for net David Miller

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1523461818-15774-7-git-send-email-michael.chan@broadcom.com \
    --to=michael.chan@broadcom.com \
    --cc=davem@davemloft.net \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.