Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7b8f622e authored by Huazhong Tan's avatar Huazhong Tan Committed by David S. Miller
Browse files

net: hns3: prevent double free in hns3_put_ring_config() 



This patch adds a check for the hns3_put_ring_config() to prevent
double free, and for more readable, move the NULL assignment of
priv->ring_data into the hns3_put_ring_config().

Signed-off-by: default avatarHuazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: default avatarPeng Li <lipeng321@huawei.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent fd85717d

drivers/net/ethernet/hisilicon/hns3/hns3_enet.c

+5 −5
Original line number Original line Diff line number Diff line
@@ -3487,6 +3487,7 @@ static int hns3_get_ring_config(struct hns3_nic_priv *priv) 
	}

	}





	devm_kfree(&pdev->dev, priv->ring_data);

	devm_kfree(&pdev->dev, priv->ring_data);

	priv->ring_data = NULL;

	return ret;

	return ret;

}

}
@@ -3495,12 +3496,16 @@ static void hns3_put_ring_config(struct hns3_nic_priv *priv) 
	struct hnae3_handle *h = priv->ae_handle;

	struct hnae3_handle *h = priv->ae_handle;

	int i;

	int i;





	if (!priv->ring_data)

		return;



	for (i = 0; i < h->kinfo.num_tqps; i++) {

	for (i = 0; i < h->kinfo.num_tqps; i++) {

		devm_kfree(priv->dev, priv->ring_data[i].ring);

		devm_kfree(priv->dev, priv->ring_data[i].ring);

		devm_kfree(priv->dev,

		devm_kfree(priv->dev,

			   priv->ring_data[i + h->kinfo.num_tqps].ring);

			   priv->ring_data[i + h->kinfo.num_tqps].ring);

	}

	}

	devm_kfree(priv->dev, priv->ring_data);

	devm_kfree(priv->dev, priv->ring_data);

	priv->ring_data = NULL;

}

}





static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)

static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring)
@@ -3920,8 +3925,6 @@ static void hns3_client_uninit(struct hnae3_handle *handle, bool reset) 




	hns3_dbg_uninit(handle);

	hns3_dbg_uninit(handle);





	priv->ring_data = NULL;



out_netdev_free:

out_netdev_free:

	free_netdev(netdev);

	free_netdev(netdev);

}

}
@@ -4268,12 +4271,10 @@ static int hns3_reset_notify_init_enet(struct hnae3_handle *handle) 
	hns3_uninit_all_ring(priv);

	hns3_uninit_all_ring(priv);

err_uninit_vector:

err_uninit_vector:

	hns3_nic_uninit_vector_data(priv);

	hns3_nic_uninit_vector_data(priv);

	priv->ring_data = NULL;

err_dealloc_vector:

err_dealloc_vector:

	hns3_nic_dealloc_vector_data(priv);

	hns3_nic_dealloc_vector_data(priv);

err_put_ring:

err_put_ring:

	hns3_put_ring_config(priv);

	hns3_put_ring_config(priv);

	priv->ring_data = NULL;





	return ret;

	return ret;

}

}
@@ -4335,7 +4336,6 @@ static int hns3_reset_notify_uninit_enet(struct hnae3_handle *handle) 
		netdev_err(netdev, "uninit ring error\n");

		netdev_err(netdev, "uninit ring error\n");





	hns3_put_ring_config(priv);

	hns3_put_ring_config(priv);

	priv->ring_data = NULL;





	return ret;

	return ret;

}

}