Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 91d9f809 authored by Maurizio Lombardi's avatar Maurizio Lombardi Committed by Christoph Hellwig
Browse files

bnx2fc: fix memory leak and potential NULL pointer dereference. 



If bnx2fc_allocate_hash_table() for some reasons fails, it is possible that the
hash_tbl_segments or the hash_tbl_pbl pointers are NULL.
In this case bnx2fc_free_hash_table() will panic the system.

this patch also fixes a memory leak, the hash_tbl_segments pointer was never
freed.

Signed-off-by: default avatarMaurizio Lombardi <mlombard@redhat.com>
Acked-by: default avatarEddie Wai <eddie.wai@broadcom.com>
Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
parent b044d149

drivers/scsi/bnx2fc/bnx2fc_hwi.c

+20 −14
Original line number Original line Diff line number Diff line
@@ -1968,9 +1968,11 @@ static void bnx2fc_free_hash_table(struct bnx2fc_hba *hba) 
	int segment_count;

	int segment_count;

	u32 *pbl;

	u32 *pbl;





	segment_count = hba->hash_tbl_segment_count;

	if (hba->hash_tbl_segments) {





		pbl = hba->hash_tbl_pbl;

		pbl = hba->hash_tbl_pbl;

		if (pbl) {

			segment_count = hba->hash_tbl_segment_count;

			for (i = 0; i < segment_count; ++i) {

			for (i = 0; i < segment_count; ++i) {

				dma_addr_t dma_address;

				dma_addr_t dma_address;
@@ -1982,7 +1984,11 @@ static void bnx2fc_free_hash_table(struct bnx2fc_hba *hba) 
						  BNX2FC_HASH_TBL_CHUNK_SIZE,

						  BNX2FC_HASH_TBL_CHUNK_SIZE,

						  hba->hash_tbl_segments[i],

						  hba->hash_tbl_segments[i],

						  dma_address);

						  dma_address);

			}

		}





		kfree(hba->hash_tbl_segments);

		hba->hash_tbl_segments = NULL;

	}

	}





	if (hba->hash_tbl_pbl) {

	if (hba->hash_tbl_pbl) {