sunvnet: free pending tx buffers before clearing ring data
authorDavid L Stevens <david.stevens@oracle.com>
Mon, 26 Jan 2015 20:54:35 +0000 (15:54 -0500)
committerDavid S. Miller <davem@davemloft.net>
Tue, 27 Jan 2015 08:25:21 +0000 (00:25 -0800)
This patch moves the clearing of ring data in vnet_port_free_tx_bufs to after
 the freeing of pending buffers in the ring. Otherwise, this can result in
 dereferencing a NULL pointer.

Reported-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: David L Stevens <david.stevens@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/sun/sunvnet.c

index b5a1d3d7b0bf627b3748e371e6adc940d82309a9..fe044f31708e61c5179c4064d5306a29e5720b48 100644 (file)
@@ -1637,16 +1637,9 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
        int i;
 
        dr = &port->vio.drings[VIO_DRIVER_TX_RING];
-       if (dr->base) {
-               ldc_free_exp_dring(port->vio.lp, dr->base,
-                                  (dr->entry_size * dr->num_entries),
-                                  dr->cookies, dr->ncookies);
-               dr->base = NULL;
-               dr->entry_size = 0;
-               dr->num_entries = 0;
-               dr->pending = 0;
-               dr->ncookies = 0;
-       }
+
+       if (dr->base == NULL)
+               return;
 
        for (i = 0; i < VNET_TX_RING_SIZE; i++) {
                struct vio_net_desc *d;
@@ -1666,6 +1659,14 @@ static void vnet_port_free_tx_bufs(struct vnet_port *port)
                port->tx_bufs[i].skb = NULL;
                d->hdr.state = VIO_DESC_FREE;
        }
+       ldc_free_exp_dring(port->vio.lp, dr->base,
+                          (dr->entry_size * dr->num_entries),
+                          dr->cookies, dr->ncookies);
+       dr->base = NULL;
+       dr->entry_size = 0;
+       dr->num_entries = 0;
+       dr->pending = 0;
+       dr->ncookies = 0;
 }
 
 static int vnet_port_alloc_tx_ring(struct vnet_port *port)