Commit 9256db4e authored by Yuri Karpov's avatar Yuri Karpov Committed by David S. Miller

net: ethernet: nixge: fix NULL dereference

In function nixge_hw_dma_bd_release() dereference of NULL pointer
priv->rx_bd_v is possible for the case of its allocation failure in
nixge_hw_dma_bd_init().

Move for() loop with priv->rx_bd_v dereference under the check for
its validity.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 492caffa ("net: ethernet: nixge: Add support for National Instruments XGE netdev")
Signed-off-by: default avatarYuri Karpov <YKarpov@ispras.ru>
Reviewed-by: default avatarMaciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent dcc14cfd
...@@ -249,6 +249,7 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev) ...@@ -249,6 +249,7 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev)
struct sk_buff *skb; struct sk_buff *skb;
int i; int i;
if (priv->rx_bd_v) {
for (i = 0; i < RX_BD_NUM; i++) { for (i = 0; i < RX_BD_NUM; i++) {
phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i], phys_addr = nixge_hw_dma_bd_get_addr(&priv->rx_bd_v[i],
phys); phys);
...@@ -263,11 +264,11 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev) ...@@ -263,11 +264,11 @@ static void nixge_hw_dma_bd_release(struct net_device *ndev)
dev_kfree_skb(skb); dev_kfree_skb(skb);
} }
if (priv->rx_bd_v)
dma_free_coherent(ndev->dev.parent, dma_free_coherent(ndev->dev.parent,
sizeof(*priv->rx_bd_v) * RX_BD_NUM, sizeof(*priv->rx_bd_v) * RX_BD_NUM,
priv->rx_bd_v, priv->rx_bd_v,
priv->rx_bd_p); priv->rx_bd_p);
}
if (priv->tx_skb) if (priv->tx_skb)
devm_kfree(ndev->dev.parent, priv->tx_skb); devm_kfree(ndev->dev.parent, priv->tx_skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment