diff options
| author | Ali Ayoub <ali@mellanox.co.il> | 2007-11-14 02:26:57 +0300 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-11-14 02:26:57 +0300 |
| commit | 3bba11e5c47dfc1d381a1ece26464fb7eea2d79c (patch) | |
| tree | 70eab30ede7905899420a52a350eb7ba15f82955 | |
| parent | 9418d5dc9ba40b88737580457bf3b7c63c60ec43 (diff) | |
| download | linux-3bba11e5c47dfc1d381a1ece26464fb7eea2d79c.tar.xz | |
mlx4_core: Fix possible bad free in mlx4_buf_free()
When mlx4_buf_free() is called from the error path of
mlx4_buf_alloc(), it may be passed a buffer structure that does not
have all pages filled in. Add a check for NULL to mlx4_buf_free() so
we avoid passing NULL to dma_free_coherent() (which will crash).
Signed-off-by: Ali Ayoub <ali@mellanox.co.il>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| -rw-r--r-- | drivers/net/mlx4/alloc.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c index f8d63d39f592..b226e019bc8b 100644 --- a/drivers/net/mlx4/alloc.c +++ b/drivers/net/mlx4/alloc.c @@ -171,9 +171,10 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf) buf->u.direct.map); else { for (i = 0; i < buf->nbufs; ++i) - dma_free_coherent(&dev->pdev->dev, PAGE_SIZE, - buf->u.page_list[i].buf, - buf->u.page_list[i].map); + if (buf->u.page_list[i].buf) + dma_free_coherent(&dev->pdev->dev, PAGE_SIZE, + buf->u.page_list[i].buf, + buf->u.page_list[i].map); kfree(buf->u.page_list); } } |