Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3bba11e5 authored by Ali Ayoub's avatar Ali Ayoub Committed by Roland Dreier
Browse files

mlx4_core: Fix possible bad free in mlx4_buf_free() 



When mlx4_buf_free() is called from the error path of
mlx4_buf_alloc(), it may be passed a buffer structure that does not
have all pages filled in.  Add a check for NULL to mlx4_buf_free() so
we avoid passing NULL to dma_free_coherent() (which will crash).

Signed-off-by: default avatarAli Ayoub <ali@mellanox.co.il>
Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 9418d5dc

drivers/net/mlx4/alloc.c

+4 −3
Original line number Diff line number Diff line
@@ -171,6 +171,7 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf) 
				  buf->u.direct.map);

	else {

		for (i = 0; i < buf->nbufs; ++i)

			if (buf->u.page_list[i].buf)

				dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,

						  buf->u.page_list[i].buf,

						  buf->u.page_list[i].map);