github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 22:52:35 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

gve: Add NULL pointer checks when freeing irqs.

Browse Source 
[ Upstream commit 5218e919c8 ]

When freeing notification blocks, we index priv->msix_vectors.
If we failed to allocate priv->msix_vectors (see abort_with_msix_vectors)
this could lead to a NULL pointer dereference if the driver is unloaded.

Fixes: 893ce44df5 ("gve: Add basic driver framework for Compute Engine Virtual NIC")
Signed-off-by: David Awogbemila <awogbemila@google.com>
Acked-by: Willem de Brujin <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
David Awogbemila 2021-05-17 14:08:13 -07:00 committed by Greg Kroah-Hartman
parent 7114438671
commit da21a35c00
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/ethernet/google/gve/gve_main.c
View File

@ -301,20 +301,22 @@ static void gve_free_notify_blocks(struct gve_priv *priv)
{ {
int i; int i;
/* Free the irqs */ if (priv->msix_vectors) {
for (i = 0; i < priv->num_ntfy_blks; i++) { /* Free the irqs */
struct gve_notify_block *block = &priv->ntfy_blocks[i]; for (i = 0; i < priv->num_ntfy_blks; i++) {
int msix_idx = i; struct gve_notify_block *block = &priv->ntfy_blocks[i];
int msix_idx = i;
irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector, irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector,
NULL); NULL);
free_irq(priv->msix_vectors[msix_idx].vector, block); free_irq(priv->msix_vectors[msix_idx].vector, block);
}
free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
} }
dma_free_coherent(&priv->pdev->dev, dma_free_coherent(&priv->pdev->dev,
priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks), priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks),
priv->ntfy_blocks, priv->ntfy_block_bus); priv->ntfy_blocks, priv->ntfy_block_bus);
priv->ntfy_blocks = NULL; priv->ntfy_blocks = NULL;
free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);
pci_disable_msix(priv->pdev); pci_disable_msix(priv->pdev);
kvfree(priv->msix_vectors); kvfree(priv->msix_vectors);
priv->msix_vectors = NULL; priv->msix_vectors = NULL;