summaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet
diff options
context:
space:
mode:
authorMichael Chan <michael.chan@broadcom.com>2018-04-11 11:50:18 -0400
committerDavid S. Miller <davem@davemloft.net>2018-04-11 14:42:00 -0400
commitcb98526bf9b985866d648dbb9c983ba9eb59daba (patch)
tree40224fb747b9e4a9733c6a4874815eff998da672 /drivers/net/ethernet
parent11c3ec7bb940b6fa3f87f05f01b7f45eef08dfbb (diff)
downloadlinux-stable-cb98526bf9b985866d648dbb9c983ba9eb59daba.tar.gz
linux-stable-cb98526bf9b985866d648dbb9c983ba9eb59daba.tar.bz2
linux-stable-cb98526bf9b985866d648dbb9c983ba9eb59daba.zip
bnxt_en: Fix NULL pointer dereference at bnxt_free_irq().
When open fails during ethtool -L ring change, for example, the driver may crash at bnxt_free_irq() because bp->bnapi is NULL. If we fail to allocate all the new rings, bnxt_open_nic() will free all the memory including bp->bnapi. Subsequent call to bnxt_close_nic() will try to dereference bp->bnapi in bnxt_free_irq(). Fix it by checking for !bp->bnapi in bnxt_free_irq(). Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") Signed-off-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet')
-rw-r--r--drivers/net/ethernet/broadcom/bnxt/bnxt.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 9cb8b4bd7312..f83769d8047b 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp)
free_irq_cpu_rmap(bp->dev->rx_cpu_rmap);
bp->dev->rx_cpu_rmap = NULL;
#endif
- if (!bp->irq_tbl)
+ if (!bp->irq_tbl || !bp->bnapi)
return;
for (i = 0; i < bp->cp_nr_rings; i++) {