Skip to content

Commit c823aba

Browse files
ffainellidavem330
authored andcommitted
net: ep93xx_eth: Do not crash unloading module
When we unload the ep93xx_eth, whether we have opened the network interface or not, we will either hit a kernel paging request error, or a simple NULL pointer de-reference because: - if ep93xx_open has been called, we have created a valid DMA mapping for ep->descs, when we call ep93xx_stop, we also call ep93xx_free_buffers, ep->descs now has a stale value - if ep93xx_open has not been called, we have a NULL pointer for ep->descs, so performing any operation against that address just won't work Fix this by adding a NULL pointer check for ep->descs which means that ep93xx_free_buffers() was able to successfully tear down the descriptors and free the DMA cookie as well. Fixes: 1d22e05 ("[PATCH] Cirrus Logic ep93xx ethernet driver") Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 34e0f2c commit c823aba

File tree

1 file changed

+4
-0
lines changed

1 file changed

+4
-0
lines changed

drivers/net/ethernet/cirrus/ep93xx_eth.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
468468
struct device *dev = ep->dev->dev.parent;
469469
int i;
470470

471+
if (!ep->descs)
472+
return;
473+
471474
for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
472475
dma_addr_t d;
473476

@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct ep93xx_priv *ep)
490493

491494
dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
492495
ep->descs_dma_addr);
496+
ep->descs = NULL;
493497
}
494498

495499
static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)

0 commit comments

Comments
 (0)