From f7b36e8f36e8f3bbebd9f4843466580354aa8179 Mon Sep 17 00:00:00 2001 From: Rahul Gupta Date: Mon, 30 Apr 2018 18:06:09 -0700 Subject: [PATCH] net/bnxt: validate structs and pointers before use Validate pointers aren't pointing to uninitialized areas including txq and rxq before using them to avoid bnxt driver from crashing. Signed-off-by: Rahul Gupta Signed-off-by: Jay Ding Signed-off-by: Scott Branden Reviewed-by: Ray Jui Reviewed-by: Ajit Khaparde Reviewed-by: Randy Schacher Tested-by: Randy Schacher --- drivers/net/bnxt/bnxt_ring.c | 3 +++ drivers/net/bnxt/bnxt_rxq.c | 6 ++---- drivers/net/bnxt/bnxt_txq.c | 9 +++++---- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/drivers/net/bnxt/bnxt_ring.c b/drivers/net/bnxt/bnxt_ring.c index 8e822e11fc..aa9f3f4cc7 100644 --- a/drivers/net/bnxt/bnxt_ring.c +++ b/drivers/net/bnxt/bnxt_ring.c @@ -24,6 +24,9 @@ void bnxt_free_ring(struct bnxt_ring *ring) { + if (!ring) + return; + if (ring->vmem_size && *ring->vmem) { memset((char *)*ring->vmem, 0, ring->vmem_size); *ring->vmem = NULL; diff --git a/drivers/net/bnxt/bnxt_rxq.c b/drivers/net/bnxt/bnxt_rxq.c index 4e6fa4e305..4b380d4f0b 100644 --- a/drivers/net/bnxt/bnxt_rxq.c +++ b/drivers/net/bnxt/bnxt_rxq.c @@ -23,10 +23,8 @@ void bnxt_free_rxq_stats(struct bnxt_rx_queue *rxq) { - struct bnxt_cp_ring_info *cpr = rxq->cp_ring; - - if (cpr->hw_stats) - cpr->hw_stats = NULL; + if (rxq && rxq->cp_ring && rxq->cp_ring->hw_stats) + rxq->cp_ring->hw_stats = NULL; } int bnxt_mq_rx_configure(struct bnxt *bp) diff --git a/drivers/net/bnxt/bnxt_txq.c b/drivers/net/bnxt/bnxt_txq.c index b50f37cf26..b9b975e4c8 100644 --- a/drivers/net/bnxt/bnxt_txq.c +++ b/drivers/net/bnxt/bnxt_txq.c @@ -19,10 +19,8 @@ void bnxt_free_txq_stats(struct bnxt_tx_queue *txq) { - struct bnxt_cp_ring_info *cpr = txq->cp_ring; - - if (cpr->hw_stats) - cpr->hw_stats = NULL; + if (txq && txq->cp_ring && txq->cp_ring->hw_stats) + txq->cp_ring->hw_stats = NULL; } static void bnxt_tx_queue_release_mbufs(struct bnxt_tx_queue *txq) @@ -30,6 +28,9 @@ static void bnxt_tx_queue_release_mbufs(struct bnxt_tx_queue *txq) struct bnxt_sw_tx_bd *sw_ring; uint16_t i; + if (!txq) + return; + sw_ring = txq->tx_ring->tx_buf_ring; if (sw_ring) { for (i = 0; i < txq->tx_ring->tx_ring_struct->ring_size; i++) { -- 2.20.1