| From: Florian Fainelli <f.fainelli@gmail.com> |
| Date: Sun, 4 Dec 2016 19:22:05 -0800 |
| Subject: net: ep93xx_eth: Do not crash unloading module |
| |
| commit c823abac17926767fb50175e098f087a6ac684c3 upstream. |
| |
| When we unload the ep93xx_eth, whether we have opened the network |
| interface or not, we will either hit a kernel paging request error, or a |
| simple NULL pointer de-reference because: |
| |
| - if ep93xx_open has been called, we have created a valid DMA mapping |
| for ep->descs, when we call ep93xx_stop, we also call |
| ep93xx_free_buffers, ep->descs now has a stale value |
| |
| - if ep93xx_open has not been called, we have a NULL pointer for |
| ep->descs, so performing any operation against that address just won't |
| work |
| |
| Fix this by adding a NULL pointer check for ep->descs which means that |
| ep93xx_free_buffers() was able to successfully tear down the descriptors |
| and free the DMA cookie as well. |
| |
| Fixes: 1d22e05df818 ("[PATCH] Cirrus Logic ep93xx ethernet driver") |
| Signed-off-by: Florian Fainelli <f.fainelli@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 ++++ |
| 1 file changed, 4 insertions(+) |
| |
| --- a/drivers/net/ethernet/cirrus/ep93xx_eth.c |
| +++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c |
| @@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct e |
| struct device *dev = ep->dev->dev.parent; |
| int i; |
| |
| + if (!ep->descs) |
| + return; |
| + |
| for (i = 0; i < RX_QUEUE_ENTRIES; i++) { |
| dma_addr_t d; |
| |
| @@ -492,6 +495,7 @@ static void ep93xx_free_buffers(struct e |
| |
| dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs, |
| ep->descs_dma_addr); |
| + ep->descs = NULL; |
| } |
| |
| static int ep93xx_alloc_buffers(struct ep93xx_priv *ep) |
