提交 47021bed 编写于 作者: H Hongchen Zhang

net: stmmac: fix potential double free of dma descriptor resources

LoongArch inclusion
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I733VA

--------------------------------

reset the dma descriptor related resource's pointer to NULL,otherwise
a potential double free problem may be triggered:
stmmac_open
  alloc_dma_desc_resources
  init_dma_desc_rings
  stmmac_hw_setup  (Failed)
    goto init_error;
  free_dma_desc_resources(priv);
  (DMA related resource pointer not reset to NULL)
...
stmmac_open
  alloc_dma_desc_resources
    alloc_dma_tx_desc_resources (Failed)
      free_dma_tx_desc_resources
      (Double free of tx_q->tx_skbuff_dma tx_q->tx_skbuff)
Signed-off-by: NHongchen Zhang <zhanghongchen@loongson.cn>
Change-Id: Ie917b7402e86cbd1b253553c10ac4a5440e38c03
上级 f3014d9a
...@@ -1635,10 +1635,15 @@ static void free_dma_rx_desc_resources(struct stmmac_priv *priv) ...@@ -1635,10 +1635,15 @@ static void free_dma_rx_desc_resources(struct stmmac_priv *priv)
dma_free_coherent(priv->device, priv->dma_rx_size * dma_free_coherent(priv->device, priv->dma_rx_size *
sizeof(struct dma_extended_desc), sizeof(struct dma_extended_desc),
rx_q->dma_erx, rx_q->dma_rx_phy); rx_q->dma_erx, rx_q->dma_rx_phy);
rx_q->dma_rx = NULL;
rx_q->dma_erx = NULL;
kfree(rx_q->buf_pool); kfree(rx_q->buf_pool);
rx_q->buf_pool = NULL;
if (rx_q->page_pool) if (rx_q->page_pool)
page_pool_destroy(rx_q->page_pool); page_pool_destroy(rx_q->page_pool);
rx_q->page_pool = NULL;
} }
} }
...@@ -1675,8 +1680,15 @@ static void free_dma_tx_desc_resources(struct stmmac_priv *priv) ...@@ -1675,8 +1680,15 @@ static void free_dma_tx_desc_resources(struct stmmac_priv *priv)
dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy); dma_free_coherent(priv->device, size, addr, tx_q->dma_tx_phy);
tx_q->dma_etx = NULL;
tx_q->dma_entx = NULL;
tx_q->dma_tx = NULL;
kfree(tx_q->tx_skbuff_dma); kfree(tx_q->tx_skbuff_dma);
tx_q->tx_skbuff_dma = NULL;
kfree(tx_q->tx_skbuff); kfree(tx_q->tx_skbuff);
tx_q->tx_skbuff = NULL;
} }
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册