From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Chan Subject: [PATCH net 6/6] bnxt_en: Fix NULL pointer dereference at bnxt_free_irq(). Date: Tue, 10 Apr 2018 23:58:13 -0400 Message-ID: <1523419093-18637-7-git-send-email-michael.chan@broadcom.com> References: <1523419093-18637-1-git-send-email-michael.chan@broadcom.com> Cc: netdev@vger.kernel.org To: davem@davemloft.net Return-path: Received: from mail-pl0-f68.google.com ([209.85.160.68]:45534 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751849AbeDKD63 (ORCPT ); Tue, 10 Apr 2018 23:58:29 -0400 Received: by mail-pl0-f68.google.com with SMTP id e22-v6so387039plj.12 for ; Tue, 10 Apr 2018 20:58:29 -0700 (PDT) In-Reply-To: <1523419093-18637-1-git-send-email-michael.chan@broadcom.com> Sender: netdev-owner@vger.kernel.org List-ID: When open fails during ethtool -L ring change, for example, the driver may crash at bnxt_free_irq() because bp->bnapi is NULL. If we fail to allocate all the new rings, bnxt_open_nic() will free all the memory including bp->bnapi. Subsequent call to bnxt_close_nic() will try to dereference bp->bnapi in bnxt_free_irq(). Fix it by checking for !bp->bnapi in bnxt_free_irq(). Fixes: e5811b8c09df ("bnxt_en: Add IRQ remapping logic.") Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 9cb8b4b..f83769d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp) free_irq_cpu_rmap(bp->dev->rx_cpu_rmap); bp->dev->rx_cpu_rmap = NULL; #endif - if (!bp->irq_tbl) + if (!bp->irq_tbl || !bp->bnapi) return; for (i = 0; i < bp->cp_nr_rings; i++) { -- 1.8.3.1