Commit daf1f1e7 authored by Michael Chan's avatar Michael Chan Committed by David S. Miller

bnxt_en: Fix NULL pointer dereference in a failure path during open.

If bnxt_hwrm_ring_free() is called during a failure path in bnxt_open(),
it is possible that the completion rings have not been allocated yet.
In that case, the completion doorbell has not been initialized, and
calling bnxt_disable_int() will crash.  Fix it by checking that the
completion ring has been initialized before writing to the completion
ring doorbell.
Signed-off-by: default avatarMichael Chan <michael.chan@broadcom.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4e00338a
...@@ -3134,7 +3134,9 @@ static void bnxt_disable_int(struct bnxt *bp) ...@@ -3134,7 +3134,9 @@ static void bnxt_disable_int(struct bnxt *bp)
for (i = 0; i < bp->cp_nr_rings; i++) { for (i = 0; i < bp->cp_nr_rings; i++) {
struct bnxt_napi *bnapi = bp->bnapi[i]; struct bnxt_napi *bnapi = bp->bnapi[i];
struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring; struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
if (ring->fw_ring_id != INVALID_HW_RING_ID)
BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons); BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment