Author: mhorne Date: Wed Dec 2 17:37:32 2020 New Revision: 368281 URL: https://svnweb.freebsd.org/changeset/base/368281
Log: em: fix a null de-reference in em_free_pci_resources A failure in iflib_device_register() can result in em_free_pci_resources() being called after receive queues have already been freed. In particular, a failure to allocate IRQ resources will goto fail_queues, where IFDI_QUEUES_FREE() will be called via iflib_tx_structures_free(), preceding the call to IFDI_DETACH(). Cope with this by checking adapter->rx_queues before dereferencing it. A similar check is present in ixgbe(4) and ixl(4). MFC after: 1 week Sponsored by: NetApp, Inc. Sponsored by: Klara, Inc. Differential Revision: https://reviews.freebsd.org/D27260 Modified: head/sys/dev/e1000/if_em.c Modified: head/sys/dev/e1000/if_em.c ============================================================================== --- head/sys/dev/e1000/if_em.c Wed Dec 2 17:22:29 2020 (r368280) +++ head/sys/dev/e1000/if_em.c Wed Dec 2 17:37:32 2020 (r368281) @@ -2234,8 +2234,10 @@ em_free_pci_resources(if_ctx_t ctx) if (adapter->intr_type == IFLIB_INTR_MSIX) iflib_irq_free(ctx, &adapter->irq); - for (int i = 0; i < adapter->rx_num_queues; i++, que++) { - iflib_irq_free(ctx, &que->que_irq); + if (que != NULL) { + for (int i = 0; i < adapter->rx_num_queues; i++, que++) { + iflib_irq_free(ctx, &que->que_irq); + } } if (adapter->memory != NULL) { _______________________________________________ svn-src-head@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-head To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
