From e354f7d60f14a3eacd5ec7b607346a5612f655ec Mon Sep 17 00:00:00 2001 From: Abdun Nihaal Date: Tue, 7 Jul 2026 11:16:16 +0530 Subject: [PATCH] bnx2x: fix null pointer dereference in bnx2x_free_mem_bp() In one of the error path in bnx2x_alloc_mem_bp(), bnx2x_free_mem_bp() may be called with bp->fp uninitialized. And so, there could be a null pointer dereference in bnx2x_free_mem_bp(). Fix that by initializing the fp_array_size after the bp->fp pointer is correctly initialized. Cc: stable+noautosel@kernel.org # untested fix to unlikely error path Reviewed-by: Maciej Fijalkowski Signed-off-by: Abdun Nihaal Reviewed-by: Simon Horman Link: https://patch.msgid.link/20260707054618.932108-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index 5b2640bd31c3..5a9742fd3ddf 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -4742,13 +4742,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) /* fp array: RSS plus CNIC related L2 queues */ fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp); - bp->fp_array_size = fp_array_size; - BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size); - - fp = kzalloc_objs(*fp, bp->fp_array_size); + BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size); + fp = kzalloc_objs(*fp, fp_array_size); if (!fp) goto alloc_err; bp->fp = fp; + bp->fp_array_size = fp_array_size; + for (i = 0; i < bp->fp_array_size; i++) { fp[i].tpa_info = kzalloc_objs(struct bnx2x_agg_info,