OSDN Git Service

bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions.
authorMichael Chan <michael.chan@broadcom.com>
Fri, 26 Apr 2019 02:31:52 +0000 (22:31 -0400)
committerDavid S. Miller <davem@davemloft.net>
Sat, 27 Apr 2019 21:00:18 +0000 (17:00 -0400)
commit1f83391bd6fc48f92f627b0ec0bce686d100c6a5
treedf19e6efe993d6bdcd7bf782091a97fe7b5bff60
parentf9099d611449836a51a65f40ea7dc9cb5f2f665e
bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions.

If we encounter errors during open and proceed to clean up,
bnxt_hwrm_ring_free() may crash if the rings we try to free have never
been allocated.  bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx()
may reference pointers that have not been allocated.

Fix it by checking for valid fw_ring_id first before calling
bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx().

Fixes: 2c61d2117ecb ("bnxt_en: Add helper functions to get firmware CP ring ID.")
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/broadcom/bnxt/bnxt.c