Commit 5218e919 authored by David Awogbemila's avatar David Awogbemila Committed by David S. Miller
Browse files

gve: Add NULL pointer checks when freeing irqs. 



When freeing notification blocks, we index priv->msix_vectors.
If we failed to allocate priv->msix_vectors (see abort_with_msix_vectors)
this could lead to a NULL pointer dereference if the driver is unloaded.

Fixes: 893ce44d ("gve: Add basic driver framework for Compute Engine Virtual NIC")
Signed-off-by: default avatarDavid Awogbemila <awogbemila@google.com>
Acked-by: default avatarWillem de Brujin <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent e96b491a

drivers/net/ethernet/google/gve/gve_main.c

+11 −9
Original line number Diff line number Diff line
@@ -301,6 +301,7 @@ static void gve_free_notify_blocks(struct gve_priv *priv) 
{

	int i;



	if (priv->msix_vectors) {

		/* Free the irqs */

		for (i = 0; i < priv->num_ntfy_blks; i++) {

			struct gve_notify_block *block = &priv->ntfy_blocks[i];
@@ -310,11 +311,12 @@ static void gve_free_notify_blocks(struct gve_priv *priv) 
					      NULL);

			free_irq(priv->msix_vectors[msix_idx].vector, block);

		}

		free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);

	}

	dma_free_coherent(&priv->pdev->dev,

			  priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks),

			  priv->ntfy_blocks, priv->ntfy_block_bus);

	priv->ntfy_blocks = NULL;

	free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv);

	pci_disable_msix(priv->pdev);

	kvfree(priv->msix_vectors);

	priv->msix_vectors = NULL;