Re: [PATCH net 03/12] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring()
flat view
From: Nicolai Buchwitz <nb@tipi-net.de>
Date: 2026-09-22 08:38:00
Also in:
lkml
On 22.9.2026 01:12, Florian Fainelli wrote:
quoted hunk ↗ jump to hunk
If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(), error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring(). Without checking if priv->rx_cbs is non-NULL, bcm_sysport_fini_rx_ring() dereferences priv->rx_cbs, resulting in a NULL pointer dereference. Add a check for !priv->rx_cbs at the beginning of bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring(). Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") Assisted-by: LLM Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com> --- drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ 1 file changed, 3 insertions(+)diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c index 8328fe824d15..b91a57540f55 100644 --- a/drivers/net/ethernet/broadcom/bcmsysport.c +++ b/drivers/net/ethernet/broadcom/bcmsysport.c@@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct bcm_sysport_priv *priv) if (!(reg & RDMA_DISABLED)) netdev_warn(priv->netdev, "RDMA not stopped!\n"); + if (!priv->rx_cbs) + return; + for (i = 0; i < priv->num_rx_bds; i++) { cb = &priv->rx_cbs[i]; if (dma_unmap_addr(cb, dma_addr))
Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Thanks, Nicolai