Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 07ac3e70 authored by David L Stevens's avatar David L Stevens Committed by David S. Miller
Browse files

sunvnet: free pending tx buffers before clearing ring data 



This patch moves the clearing of ring data in vnet_port_free_tx_bufs to after
 the freeing of pending buffers in the ring. Otherwise, this can result in
 dereferencing a NULL pointer.

Reported-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: default avatarDavid L Stevens <david.stevens@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 971f49de

drivers/net/ethernet/sun/sunvnet.c

+11 −10
Original line number Original line Diff line number Diff line
@@ -1637,16 +1637,9 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port) 
	int i;

	int i;





	dr = &port->vio.drings[VIO_DRIVER_TX_RING];

	dr = &port->vio.drings[VIO_DRIVER_TX_RING];

	if (dr->base) {



		ldc_free_exp_dring(port->vio.lp, dr->base,

	if (dr->base == NULL)

				   (dr->entry_size * dr->num_entries),

		return;

				   dr->cookies, dr->ncookies);

		dr->base = NULL;

		dr->entry_size = 0;

		dr->num_entries = 0;

		dr->pending = 0;

		dr->ncookies = 0;

	}





	for (i = 0; i < VNET_TX_RING_SIZE; i++) {

	for (i = 0; i < VNET_TX_RING_SIZE; i++) {

		struct vio_net_desc *d;

		struct vio_net_desc *d;
@@ -1666,6 +1659,14 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port) 
		port->tx_bufs[i].skb = NULL;

		port->tx_bufs[i].skb = NULL;

		d->hdr.state = VIO_DESC_FREE;

		d->hdr.state = VIO_DESC_FREE;

	}

	}

	ldc_free_exp_dring(port->vio.lp, dr->base,

			   (dr->entry_size * dr->num_entries),

			   dr->cookies, dr->ncookies);

	dr->base = NULL;

	dr->entry_size = 0;

	dr->num_entries = 0;

	dr->pending = 0;

	dr->ncookies = 0;

}

}





static int vnet_port_alloc_tx_ring(struct vnet_port *port)

static int vnet_port_alloc_tx_ring(struct vnet_port *port)