aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAli Ayoub <ali@mellanox.co.il>2007-11-13 18:26:57 -0500
committerRoland Dreier <rolandd@cisco.com>2007-11-13 18:26:57 -0500
commit3bba11e5c47dfc1d381a1ece26464fb7eea2d79c (patch)
tree70eab30ede7905899420a52a350eb7ba15f82955
parent9418d5dc9ba40b88737580457bf3b7c63c60ec43 (diff)
mlx4_core: Fix possible bad free in mlx4_buf_free()
When mlx4_buf_free() is called from the error path of mlx4_buf_alloc(), it may be passed a buffer structure that does not have all pages filled in. Add a check for NULL to mlx4_buf_free() so we avoid passing NULL to dma_free_coherent() (which will crash). Signed-off-by: Ali Ayoub <ali@mellanox.co.il> Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il> Signed-off-by: Roland Dreier <rolandd@cisco.com>
-rw-r--r--drivers/net/mlx4/alloc.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index f8d63d39f592..b226e019bc8b 100644
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -171,9 +171,10 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf)
171 buf->u.direct.map); 171 buf->u.direct.map);
172 else { 172 else {
173 for (i = 0; i < buf->nbufs; ++i) 173 for (i = 0; i < buf->nbufs; ++i)
174 dma_free_coherent(&dev->pdev->dev, PAGE_SIZE, 174 if (buf->u.page_list[i].buf)
175 buf->u.page_list[i].buf, 175 dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
176 buf->u.page_list[i].map); 176 buf->u.page_list[i].buf,
177 buf->u.page_list[i].map);
177 kfree(buf->u.page_list); 178 kfree(buf->u.page_list);
178 } 179 }
179} 180}