Commit 96e31adf authored by Rasesh Mody's avatar Rasesh Mody Committed by David S. Miller

bna: Add NULL Check Before Dereferencing TCB

Currently we already check to see whether the BNAD_TXQ_TX_STARTED cleared.
But if the tcb structure which contains this flag is also already freed by that
time, we would dereference the NULL pointer. This patch is to check tcb for NULL
pointer, before dereferencing it.
Signed-off-by: default avatarRasesh Mody <rmody@brocade.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 17a30a14
...@@ -2958,21 +2958,21 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev) ...@@ -2958,21 +2958,21 @@ bnad_start_xmit(struct sk_buff *skb, struct net_device *netdev)
} }
tcb = bnad->tx_info[0].tcb[txq_id]; tcb = bnad->tx_info[0].tcb[txq_id];
q_depth = tcb->q_depth;
prod = tcb->producer_index;
unmap_q = tcb->unmap_q;
/* /*
* Takes care of the Tx that is scheduled between clearing the flag * Takes care of the Tx that is scheduled between clearing the flag
* and the netif_tx_stop_all_queues() call. * and the netif_tx_stop_all_queues() call.
*/ */
if (unlikely(!test_bit(BNAD_TXQ_TX_STARTED, &tcb->flags))) { if (unlikely(!tcb || !test_bit(BNAD_TXQ_TX_STARTED, &tcb->flags))) {
dev_kfree_skb(skb); dev_kfree_skb(skb);
BNAD_UPDATE_CTR(bnad, tx_skb_stopping); BNAD_UPDATE_CTR(bnad, tx_skb_stopping);
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }
q_depth = tcb->q_depth;
prod = tcb->producer_index;
unmap_q = tcb->unmap_q;
vectors = 1 + skb_shinfo(skb)->nr_frags; vectors = 1 + skb_shinfo(skb)->nr_frags;
wis = BNA_TXQ_WI_NEEDED(vectors); /* 4 vectors per work item */ wis = BNA_TXQ_WI_NEEDED(vectors); /* 4 vectors per work item */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment