Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1f83391b authored by Michael Chan's avatar Michael Chan Committed by David S. Miller
Browse files

bnxt_en: Fix possible crash in bnxt_hwrm_ring_free() under error conditions. 



If we encounter errors during open and proceed to clean up,
bnxt_hwrm_ring_free() may crash if the rings we try to free have never
been allocated.  bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx()
may reference pointers that have not been allocated.

Fix it by checking for valid fw_ring_id first before calling
bnxt_cp_ring_for_rx() or bnxt_cp_ring_for_tx().

Fixes: 2c61d211 ("bnxt_en: Add helper functions to get firmware CP ring ID.")
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f9099d61

drivers/net/ethernet/broadcom/bnxt/bnxt.c

+6 −6
Original line number Diff line number Diff line
@@ -5135,10 +5135,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) 
	for (i = 0; i < bp->tx_nr_rings; i++) {

		struct bnxt_tx_ring_info *txr = &bp->tx_ring[i];

		struct bnxt_ring_struct *ring = &txr->tx_ring_struct;

		u32 cmpl_ring_id;



		cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);

		if (ring->fw_ring_id != INVALID_HW_RING_ID) {

			u32 cmpl_ring_id = bnxt_cp_ring_for_tx(bp, txr);



			hwrm_ring_free_send_msg(bp, ring,

						RING_FREE_REQ_RING_TYPE_TX,

						close_path ? cmpl_ring_id :
@@ -5151,10 +5151,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) 
		struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];

		struct bnxt_ring_struct *ring = &rxr->rx_ring_struct;

		u32 grp_idx = rxr->bnapi->index;

		u32 cmpl_ring_id;



		cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);

		if (ring->fw_ring_id != INVALID_HW_RING_ID) {

			u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);



			hwrm_ring_free_send_msg(bp, ring,

						RING_FREE_REQ_RING_TYPE_RX,

						close_path ? cmpl_ring_id :
@@ -5173,10 +5173,10 @@ static void bnxt_hwrm_ring_free(struct bnxt *bp, bool close_path) 
		struct bnxt_rx_ring_info *rxr = &bp->rx_ring[i];

		struct bnxt_ring_struct *ring = &rxr->rx_agg_ring_struct;

		u32 grp_idx = rxr->bnapi->index;

		u32 cmpl_ring_id;



		cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);

		if (ring->fw_ring_id != INVALID_HW_RING_ID) {

			u32 cmpl_ring_id = bnxt_cp_ring_for_rx(bp, rxr);



			hwrm_ring_free_send_msg(bp, ring, type,

						close_path ? cmpl_ring_id :

						INVALID_HW_RING_ID);