aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMichael Chan2017-02-20 19:25:17 -0500
committerDavid S. Miller2017-02-20 21:59:15 -0500
commitdaf1f1e7841138cb0e48d52c8573a5f064d8f495 (patch)
tree02f76b565b4e3fa80bee41bacc1da0c851e92684
parent4e00338a61998de3502d0428c4f71ffc69772316 (diff)
bnxt_en: Fix NULL pointer dereference in a failure path during open.
If bnxt_hwrm_ring_free() is called during a failure path in bnxt_open(), it is possible that the completion rings have not been allocated yet. In that case, the completion doorbell has not been initialized, and calling bnxt_disable_int() will crash. Fix it by checking that the completion ring has been initialized before writing to the completion ring doorbell. Signed-off-by: Michael Chan <michael.chan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/ethernet/broadcom/bnxt/bnxt.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index f4dec1bdd911..37b9f65f682d 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -3134,8 +3134,10 @@ static void bnxt_disable_int(struct bnxt *bp)
for (i = 0; i < bp->cp_nr_rings; i++) {
struct bnxt_napi *bnapi = bp->bnapi[i];
struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+ struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
- BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
+ if (ring->fw_ring_id != INVALID_HW_RING_ID)
+ BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
}
}