Skip to content

Commit a9b9741

Browse files
Aleksandr Mishinkuba-moo
authored andcommitted
bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send()
In case of token is released due to token->state == BNXT_HWRM_DEFERRED, released token (set to NULL) is used in log messages. This issue is expected to be prevented by HWRM_ERR_CODE_PF_UNAVAILABLE error code. But this error code is returned by recent firmware. So some firmware may not return it. This may lead to NULL pointer dereference. Adjust this issue by adding token pointer check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 8fa4219 ("bnxt_en: add dynamic debug support for HWRM messages") Suggested-by: Michael Chan <[email protected]> Signed-off-by: Aleksandr Mishin <[email protected]> Reviewed-by: Wojciech Drewek <[email protected]> Reviewed-by: Michael Chan <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Jakub Kicinski <[email protected]>
1 parent a6736a0 commit a9b9741

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/net/ethernet/broadcom/bnxt/bnxt_hwrm.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -680,7 +680,7 @@ static int __hwrm_send(struct bnxt *bp, struct bnxt_hwrm_ctx *ctx)
680680
req_type);
681681
else if (rc && rc != HWRM_ERR_CODE_PF_UNAVAILABLE)
682682
hwrm_err(bp, ctx, "hwrm req_type 0x%x seq id 0x%x error 0x%x\n",
683-
req_type, token->seq_id, rc);
683+
req_type, le16_to_cpu(ctx->req->seq_id), rc);
684684
rc = __hwrm_to_stderr(rc);
685685
exit:
686686
if (token)

0 commit comments

Comments
 (0)