提交 127d0a19 编写于 作者: M Michal Schmidt 提交者: David S. Miller

bnx2x: fix a crash on corrupt firmware file

If the requested firmware is deemed corrupt and then released, reset the
pointer to NULL in order to avoid double-freeing it in
bnx2x_release_firmware() or dereferencing it in bnx2x_init_firmware().
Signed-off-by: NMichal Schmidt <mschmidt@redhat.com>
Acked-by: NEilon Greenstein <eilong@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 cc34eb67
...@@ -10901,6 +10901,7 @@ int bnx2x_init_firmware(struct bnx2x *bp) ...@@ -10901,6 +10901,7 @@ int bnx2x_init_firmware(struct bnx2x *bp)
kfree(bp->init_data); kfree(bp->init_data);
request_firmware_exit: request_firmware_exit:
release_firmware(bp->firmware); release_firmware(bp->firmware);
bp->firmware = NULL;
return rc; return rc;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册