Skip to content

Commit cb98526

Browse files
Michael Chandavem330
authored andcommitted
bnxt_en: Fix NULL pointer dereference at bnxt_free_irq().
When open fails during ethtool -L ring change, for example, the driver may crash at bnxt_free_irq() because bp->bnapi is NULL. If we fail to allocate all the new rings, bnxt_open_nic() will free all the memory including bp->bnapi. Subsequent call to bnxt_close_nic() will try to dereference bp->bnapi in bnxt_free_irq(). Fix it by checking for !bp->bnapi in bnxt_free_irq(). Fixes: e5811b8 ("bnxt_en: Add IRQ remapping logic.") Signed-off-by: Michael Chan <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 11c3ec7 commit cb98526

File tree

1 file changed

+1
-1
lines changed
  • drivers/net/ethernet/broadcom/bnxt

1 file changed

+1
-1
lines changed

drivers/net/ethernet/broadcom/bnxt/bnxt.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6090,7 +6090,7 @@ static void bnxt_free_irq(struct bnxt *bp)
60906090
free_irq_cpu_rmap(bp->dev->rx_cpu_rmap);
60916091
bp->dev->rx_cpu_rmap = NULL;
60926092
#endif
6093-
if (!bp->irq_tbl)
6093+
if (!bp->irq_tbl || !bp->bnapi)
60946094
return;
60956095

60966096
for (i = 0; i < bp->cp_nr_rings; i++) {

0 commit comments

Comments
 (0)