[PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[Jiangshan Yi]

bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
which dereferences bp->fp in a loop bounded by the non-zero
bp->fp_array_size, causing a NULL pointer dereference.

Move the bp->fp_array_size assignment to after bp->fp is set, and
add a NULL guard in bnx2x_free_mem_bp().

Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan%40kylinos.cn
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 5b2640bd31c3..d84d1845a096 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -4712,8 +4712,10 @@ void bnx2x_free_mem_bp(struct bnx2x *bp)
 {
 	int i;
 
-	for (i = 0; i < bp->fp_array_size; i++)
-		kfree(bp->fp[i].tpa_info);
+	if (bp->fp) {
+		for (i = 0; i < bp->fp_array_size; i++)
+			kfree(bp->fp[i].tpa_info);
+	}
 	kfree(bp->fp);
 	kfree(bp->sp_objs);
 	kfree(bp->fp_stats);
@@ -4742,13 +4744,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
 
 	/* fp array: RSS plus CNIC related L2 queues */
 	fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp);
-	bp->fp_array_size = fp_array_size;
-	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
+	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
 
-	fp = kzalloc_objs(*fp, bp->fp_array_size);
+	fp = kzalloc_objs(*fp, fp_array_size);
 	if (!fp)
 		goto alloc_err;
 	bp->fp = fp;
+	bp->fp_array_size = fp_array_size;
 	for (i = 0; i < bp->fp_array_size; i++) {
 		fp[i].tpa_info =
 			kzalloc_objs(struct bnx2x_agg_info,
-- 
2.25.1

Re: [PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[Vadim Fedorenko]

On 17/08/2026 04:33, Jiangshan Yi wrote:
> bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
> If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
> which dereferences bp->fp in a loop bounded by the non-zero
> bp->fp_array_size, causing a NULL pointer dereference.
> 
> Move the bp->fp_array_size assignment to after bp->fp is set, and
> add a NULL guard in bnx2x_free_mem_bp().
> 
> Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan%40kylinos.cn
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
>   drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 12 +++++++-----
>   1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> index 5b2640bd31c3..d84d1845a096 100644
> --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
> @@ -4712,8 +4712,10 @@ void bnx2x_free_mem_bp(struct bnx2x *bp)
>   {
>   	int i;
>   
> -	for (i = 0; i < bp->fp_array_size; i++)
> -		kfree(bp->fp[i].tpa_info);
> +	if (bp->fp) {

there is no need to put this defensive code ...

> +		for (i = 0; i < bp->fp_array_size; i++)
> +			kfree(bp->fp[i].tpa_info);
> +	}
>   	kfree(bp->fp);
>   	kfree(bp->sp_objs);
>   	kfree(bp->fp_stats);
> @@ -4742,13 +4744,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
>   
>   	/* fp array: RSS plus CNIC related L2 queues */
>   	fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp);
> -	bp->fp_array_size = fp_array_size;
> -	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
> +	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
>   
> -	fp = kzalloc_objs(*fp, bp->fp_array_size);
> +	fp = kzalloc_objs(*fp, fp_array_size);
>   	if (!fp)
>   		goto alloc_err;
>   	bp->fp = fp;
> +	bp->fp_array_size = fp_array_size;

... when you have fixed the root cause of the issue

>   	for (i = 0; i < bp->fp_array_size; i++) {
>   		fp[i].tpa_info =
>   			kzalloc_objs(struct bnx2x_agg_info,

Re: Re: [PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[Jiangshan Yi]

> > +	if (bp->fp) {
> there is no need to put this defensive code ...
> > +		for (i = 0; i < bp->fp_array_size; i++)
> > +			kfree(bp->fp[i].tpa_info);
> > +	}
> ......
> > -	bp->fp_array_size = fp_array_size;
> > -	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
> > +	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
> >   
> > -	fp = kzalloc_objs(*fp, bp->fp_array_size);
> > +	fp = kzalloc_objs(*fp, fp_array_size);
> >   	if (!fp)
> >   		goto alloc_err;
> >   	bp->fp = fp;
> > +	bp->fp_array_size = fp_array_size;
> ... when you have fixed the root cause of the issue


Hi Vadim,

Thanks for the review. You're right - once the bp->fp_array_size assignment is moved after bp->fp is set, the loop in bnx2x_free_mem_bp() naturally won't execute
when bp->fp is NULL, since bp->fp_array_size remains zero. The if (bp->fp) guard is indeed redundant. I'll remove it and send a v2 with only the assignment-order
fix.

Best regards,
Jiangshan Yi