Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e829a72d authored by Joe Jin's avatar Joe Jin Committed by Sasha Levin
Browse files

xen-netfront: update num_queues to real created 



[ Upstream commit ca88ea1247dfee094e2467a3578eaec9bdf0833a ]

Sometimes xennet_create_queues() may failed to created all requested
queues, we need to update num_queues to real created to avoid NULL
pointer dereference.

Signed-off-by: default avatarJoe Jin <joe.jin@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: David S. Miller <davem@davemloft.net>
Reviewed-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent aa57c62d

drivers/net/xen-netfront.c

+7 −7
Original line number Diff line number Diff line
@@ -1792,19 +1792,19 @@ static void xennet_destroy_queues(struct netfront_info *info) 
}



static int xennet_create_queues(struct netfront_info *info,

				unsigned int num_queues)

				unsigned int *num_queues)

{

	unsigned int i;

	int ret;



	info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),

	info->queues = kcalloc(*num_queues, sizeof(struct netfront_queue),

			       GFP_KERNEL);

	if (!info->queues)

		return -ENOMEM;



	rtnl_lock();



	for (i = 0; i < num_queues; i++) {

	for (i = 0; i < *num_queues; i++) {

		struct netfront_queue *queue = &info->queues[i];



		queue->id = i;
@@ -1814,7 +1814,7 @@ static int xennet_create_queues(struct netfront_info *info, 
		if (ret < 0) {

			dev_warn(&info->netdev->dev,

				 "only created %d queues\n", i);

			num_queues = i;

			*num_queues = i;

			break;

		}
@@ -1824,11 +1824,11 @@ static int xennet_create_queues(struct netfront_info *info, 
			napi_enable(&queue->napi);

	}



	netif_set_real_num_tx_queues(info->netdev, num_queues);

	netif_set_real_num_tx_queues(info->netdev, *num_queues);



	rtnl_unlock();



	if (num_queues == 0) {

	if (*num_queues == 0) {

		dev_err(&info->netdev->dev, "no queues\n");

		return -EINVAL;

	}
@@ -1874,7 +1874,7 @@ static int talk_to_netback(struct xenbus_device *dev, 
	if (info->queues)

		xennet_destroy_queues(info);



	err = xennet_create_queues(info, num_queues);

	err = xennet_create_queues(info, &num_queues);

	if (err < 0)

		goto destroy_ring;