Re: [PATCH v2] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()
Vadim Fedorenko <[email protected]>
| Newsgroups | org.kernel.vger.stable,org.kernel.vger.linux-kernel,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
On 17/08/2026 16:13, Jiangshan Yi wrote:
> bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
> If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
> which dereferences bp->fp in a loop bounded by the non-zero
> bp->fp_array_size, causing a NULL pointer dereference.
>
> Move the bp->fp_array_size assignment to after bp->fp is set so that
> the loop in bnx2x_free_mem_bp() naturally becomes a no-op when bp->fp
> is NULL, since bp is zero-initialized and fp_array_size remains 0.
>
> Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/patchset/[email protected]
> Suggested-by: Vadim Fedorenko <[email protected]>
No need for this tag, it's not used for code improvements
> Cc: [email protected]
> Signed-off-by: Jiangshan Yi <[email protected]>
Please, review netdev contribution rules at
https://docs.kernel.org/process/maintainer-netdev.html
Especially patch formatting and 24h cool-down period