diff options
| author | Michael Chan <michael.chan@broadcom.com> | 2017-02-21 03:25:17 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2017-02-21 05:59:15 +0300 |
| commit | daf1f1e7841138cb0e48d52c8573a5f064d8f495 (patch) | |
| tree | 02f76b565b4e3fa80bee41bacc1da0c851e92684 | |
| parent | 4e00338a61998de3502d0428c4f71ffc69772316 (diff) | |
| download | linux-daf1f1e7841138cb0e48d52c8573a5f064d8f495.tar.xz | |
bnxt_en: Fix NULL pointer dereference in a failure path during open.
If bnxt_hwrm_ring_free() is called during a failure path in bnxt_open(),
it is possible that the completion rings have not been allocated yet.
In that case, the completion doorbell has not been initialized, and
calling bnxt_disable_int() will crash. Fix it by checking that the
completion ring has been initialized before writing to the completion
ring doorbell.
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index f4dec1bdd911..37b9f65f682d 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -3134,8 +3134,10 @@ static void bnxt_disable_int(struct bnxt *bp) for (i = 0; i < bp->cp_nr_rings; i++) { struct bnxt_napi *bnapi = bp->bnapi[i]; struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring; + struct bnxt_ring_struct *ring = &cpr->cp_ring_struct; - BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons); + if (ring->fw_ring_id != INVALID_HW_RING_ID) + BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons); } } |