[PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()
From: Jiangshan Yi <hidden>
Date: 2026-08-17 03:33:41
Also in:
lkml, stable
Subsystem:
broadcom bnx2x 10 gigabit ethernet driver, networking drivers, the rest · Maintainers:
Sudarsana Kalluru, Manish Chopra, Andrew Lunn, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
bnx2x_alloc_mem_bp() sets bp->fp_array_size before allocating bp->fp.
If the fp allocation fails, the error path calls bnx2x_free_mem_bp(),
which dereferences bp->fp in a loop bounded by the non-zero
bp->fp_array_size, causing a NULL pointer dereference.
Move the bp->fp_array_size assignment to after bp->fp is set, and
add a NULL guard in bnx2x_free_mem_bp().
Fixes: c3146eb676e7c ("bnx2x: Correct memory preparation and release")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260815122149.951215-1-yijiangshan%40kylinos.cn
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <redacted>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 5b2640bd31c3..d84d1845a096 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c@@ -4712,8 +4712,10 @@ void bnx2x_free_mem_bp(struct bnx2x *bp) { int i; - for (i = 0; i < bp->fp_array_size; i++) - kfree(bp->fp[i].tpa_info); + if (bp->fp) { + for (i = 0; i < bp->fp_array_size; i++) + kfree(bp->fp[i].tpa_info); + } kfree(bp->fp); kfree(bp->sp_objs); kfree(bp->fp_stats);
@@ -4742,13 +4744,13 @@ int bnx2x_alloc_mem_bp(struct bnx2x *bp) /* fp array: RSS plus CNIC related L2 queues */ fp_array_size = BNX2X_MAX_RSS_COUNT(bp) + CNIC_SUPPORT(bp); - bp->fp_array_size = fp_array_size; - BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size); + BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size); - fp = kzalloc_objs(*fp, bp->fp_array_size); + fp = kzalloc_objs(*fp, fp_array_size); if (!fp) goto alloc_err; bp->fp = fp; + bp->fp_array_size = fp_array_size; for (i = 0; i < bp->fp_array_size; i++) { fp[i].tpa_info = kzalloc_objs(struct bnx2x_agg_info,
--
2.25.1