Thread (3 messages) flat view 3 messages, 2 authors, 2026-08-17

Re: Re: [PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

From: Jiangshan Yi <hidden>
Date: 2026-08-17 15:08:19
Also in: lkml, stable

quoted
+	if (bp->fp) {
there is no need to put this defensive code ...
quoted
+		for (i = 0; i < bp->fp_array_size; i++)
+			kfree(bp->fp[i].tpa_info);
+	}
......
quoted
-	bp->fp_array_size = fp_array_size;
-	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
+	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
  
-	fp = kzalloc_objs(*fp, bp->fp_array_size);
+	fp = kzalloc_objs(*fp, fp_array_size);
  	if (!fp)
  		goto alloc_err;
  	bp->fp = fp;
+	bp->fp_array_size = fp_array_size;
... when you have fixed the root cause of the issue

Hi Vadim,

Thanks for the review. You're right - once the bp->fp_array_size assignment is moved after bp->fp is set, the loop in bnx2x_free_mem_bp() naturally won't execute
when bp->fp is NULL, since bp->fp_array_size remains zero. The if (bp->fp) guard is indeed redundant. I'll remove it and send a v2 with only the assignment-order
fix.

Best regards,
Jiangshan Yi
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help