bnx2fc: fix memory leak and potential NULL pointer dereference.
If bnx2fc_allocate_hash_table() for some reasons fails, it is possible that the hash_tbl_segments or the hash_tbl_pbl pointers are NULL. In this case bnx2fc_free_hash_table() will panic the system. this patch also fixes a memory leak, the hash_tbl_segments pointer was never freed. Signed-off-by: Maurizio Lombardi <mlombard@redhat.com> Acked-by: Eddie Wai <eddie.wai@broadcom.com> Signed-off-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
parent
b044d1498c
commit
91d9f809da
|
@ -1968,21 +1968,27 @@ static void bnx2fc_free_hash_table(struct bnx2fc_hba *hba)
|
|||
int segment_count;
|
||||
u32 *pbl;
|
||||
|
||||
segment_count = hba->hash_tbl_segment_count;
|
||||
if (hba->hash_tbl_segments) {
|
||||
|
||||
pbl = hba->hash_tbl_pbl;
|
||||
for (i = 0; i < segment_count; ++i) {
|
||||
dma_addr_t dma_address;
|
||||
pbl = hba->hash_tbl_pbl;
|
||||
if (pbl) {
|
||||
segment_count = hba->hash_tbl_segment_count;
|
||||
for (i = 0; i < segment_count; ++i) {
|
||||
dma_addr_t dma_address;
|
||||
|
||||
dma_address = le32_to_cpu(*pbl);
|
||||
++pbl;
|
||||
dma_address += ((u64)le32_to_cpu(*pbl)) << 32;
|
||||
++pbl;
|
||||
dma_free_coherent(&hba->pcidev->dev,
|
||||
BNX2FC_HASH_TBL_CHUNK_SIZE,
|
||||
hba->hash_tbl_segments[i],
|
||||
dma_address);
|
||||
dma_address = le32_to_cpu(*pbl);
|
||||
++pbl;
|
||||
dma_address += ((u64)le32_to_cpu(*pbl)) << 32;
|
||||
++pbl;
|
||||
dma_free_coherent(&hba->pcidev->dev,
|
||||
BNX2FC_HASH_TBL_CHUNK_SIZE,
|
||||
hba->hash_tbl_segments[i],
|
||||
dma_address);
|
||||
}
|
||||
}
|
||||
|
||||
kfree(hba->hash_tbl_segments);
|
||||
hba->hash_tbl_segments = NULL;
|
||||
}
|
||||
|
||||
if (hba->hash_tbl_pbl) {
|
||||
|
|
Loading…
Reference in New Issue