Commit cb98526b authored by Michael Chan's avatar Michael Chan Committed by David S. Miller

bnxt_en: Fix NULL pointer dereference at bnxt_free_irq().

When open fails during ethtool -L ring change, for example, the driver
may crash at bnxt_free_irq() because bp->bnapi is NULL.

If we fail to allocate all the new rings, bnxt_open_nic() will free
all the memory including bp->bnapi.  Subsequent call to bnxt_close_nic()
will try to dereference bp->bnapi in bnxt_free_irq().

Fix it by checking for !bp->bnapi in bnxt_free_irq().

Fixes: e5811b8c ("bnxt_en: Add IRQ remapping logic.")
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 11c3ec7b
...@@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp) ...@@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp)
free_irq_cpu_rmap(bp->dev->rx_cpu_rmap); free_irq_cpu_rmap(bp->dev->rx_cpu_rmap);
bp->dev->rx_cpu_rmap = NULL; bp->dev->rx_cpu_rmap = NULL;
#endif #endif
if (!bp->irq_tbl) if (!bp->irq_tbl || !bp->bnapi)
return; return;
for (i = 0; i < bp->cp_nr_rings; i++) { for (i = 0; i < bp->cp_nr_rings; i++) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment