diff options
| author | Eric Dumazet <edumazet@google.com> | 2014-06-26 11:44:02 +0400 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-07-29 18:57:00 +0400 |
| commit | 7ec8d47ae13d5bdb1703767f3c2366efa6e2b6eb (patch) | |
| tree | f050a0b740ac6d8144f4f2e3dd039aab0288dae3 /drivers/net/ethernet/broadcom | |
| parent | 8728b0c1932dada25f2d1ccfa1669b5b41fe7937 (diff) | |
| download | linux-7ec8d47ae13d5bdb1703767f3c2366efa6e2b6eb.tar.xz | |
bnx2x: fix possible panic under memory stress
[ Upstream commit 07b0f00964def8af9321cfd6c4a7e84f6362f728 ]
While it is legal to kfree(NULL), it is not wise to use :
put_page(virt_to_head_page(NULL))
BUG: unable to handle kernel paging request at ffffeba400000000
IP: [<ffffffffc01f5928>] virt_to_head_page+0x36/0x44 [bnx2x]
Reported-by: Michel Lespinasse <walken@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Ariel Elior <ariel.elior@qlogic.com>
Fixes: d46d132cc021 ("bnx2x: use netdev_alloc_frag()")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Diffstat (limited to 'drivers/net/ethernet/broadcom')
| -rw-r--r-- | drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index 0399458e6d44..9846d3e712a1 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -755,7 +755,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, return; } - bnx2x_frag_free(fp, new_data); + if (new_data) + bnx2x_frag_free(fp, new_data); drop: /* drop the packet and keep the buffer in the bin */ DP(NETIF_MSG_RX_STATUS, |