Commit 914adb55 authored by Florian Fainelli's avatar Florian Fainelli Committed by David S. Miller

net: systemport: do not crash freeing an unitialized TX ring

Callers of bcm_sysport_init_tx_ring() can currently fail, and will
always call bcm_sysport_fini_tx_ring() in a loop ending at the number of
TX queues (32) without checking if the TX ring was successfully
initialized or not.

Update bcm_sysport_fini_tx_ring() to return early and avoid a crash
de-referencing ring->cbs if the TX ring was not initialized, since
ring->cbs is the last part of the initialization done by
bcm_sysport_init_tx_ring() that could fail.

Fixes: 80105bef ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
Reported-by: default avatarMaxime Bizon <mbizon@freebox.fr>
Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3e8fc38c
...@@ -1175,6 +1175,13 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv, ...@@ -1175,6 +1175,13 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
if (!(reg & TDMA_DISABLED)) if (!(reg & TDMA_DISABLED))
netdev_warn(priv->netdev, "TDMA not stopped!\n"); netdev_warn(priv->netdev, "TDMA not stopped!\n");
/* ring->cbs is the last part in bcm_sysport_init_tx_ring which could
* fail, so by checking this pointer we know whether the TX ring was
* fully initialized or not.
*/
if (!ring->cbs)
return;
napi_disable(&ring->napi); napi_disable(&ring->napi);
netif_napi_del(&ring->napi); netif_napi_del(&ring->napi);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment