diff options
| author | Florian Fainelli <f.fainelli@gmail.com> | 2016-12-04 19:22:05 -0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-02-23 03:51:02 +0000 |
| commit | f05f3a72f505ed1ab46b6a50cb1e67c0cf975545 (patch) | |
| tree | d4a132e9d9c4b21697d7f5a83289d0738690a68d | |
| parent | 301cd43f1ed7fd5ef6fff6e53ee65ecd4833d385 (diff) | |
| download | linux-f05f3a72f505ed1ab46b6a50cb1e67c0cf975545.tar.gz linux-f05f3a72f505ed1ab46b6a50cb1e67c0cf975545.tar.bz2 linux-f05f3a72f505ed1ab46b6a50cb1e67c0cf975545.zip | |
net: ep93xx_eth: Do not crash unloading module
commit c823abac17926767fb50175e098f087a6ac684c3 upstream.
When we unload the ep93xx_eth, whether we have opened the network
interface or not, we will either hit a kernel paging request error, or a
simple NULL pointer de-reference because:
- if ep93xx_open has been called, we have created a valid DMA mapping
for ep->descs, when we call ep93xx_stop, we also call
ep93xx_free_buffers, ep->descs now has a stale value
- if ep93xx_open has not been called, we have a NULL pointer for
ep->descs, so performing any operation against that address just won't
work
Fix this by adding a NULL pointer check for ep->descs which means that
ep93xx_free_buffers() was able to successfully tear down the descriptors
and free the DMA cookie as well.
Fixes: 1d22e05df818 ("[PATCH] Cirrus Logic ep93xx ethernet driver")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/ethernet/cirrus/ep93xx_eth.c b/drivers/net/ethernet/cirrus/ep93xx_eth.c index 4317af8d2f0a..6c9bd559a7ef 100644 --- a/drivers/net/ethernet/cirrus/ep93xx_eth.c +++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c @@ -469,6 +469,9 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep) struct device *dev = ep->dev->dev.parent; int i; + if (!ep->descs) + return; + for (i = 0; i < RX_QUEUE_ENTRIES; i++) { dma_addr_t d; @@ -493,6 +496,7 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep) dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs, ep->descs_dma_addr); + ep->descs = NULL; } static int ep93xx_alloc_buffers(struct ep93xx_priv *ep) |