github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()

Browse Source 
In one of the error path in bnx2x_alloc_mem_bp(), bnx2x_free_mem_bp()
may be called with bp->fp uninitialized. And so, there could be a null
pointer dereference in bnx2x_free_mem_bp(). Fix that by initializing the
fp_array_size after the bp->fp pointer is correctly initialized.

Cc: stable+noautosel@kernel.org # untested fix to unlikely error path
Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260707054618.932108-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Abdun Nihaal 2026-07-07 11:16:16 +05:30 committed by Jakub Kicinski
parent 298bb2b890
commit e354f7d60f
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
View File

@ -4742,13 +4742,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp)
/* fp array: RSS plus CNIC related L2 queues */
fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp);
bp->fp_array_size = fp_array_size;
BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
fp = kzalloc_objs(*fp, bp->fp_array_size);
BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
fp = kzalloc_objs(*fp, fp_array_size);
if (!fp)
goto alloc_err;
bp->fp = fp;
bp->fp_array_size = fp_array_size;
for (i = 0; i < bp->fp_array_size; i++) {
fp[i].tpa_info =
kzalloc_objs(struct bnx2x_agg_info,