Messages in this thread Patch in this message | | | Subject | Re: [PATCH] drivers/net/fjes: fix a potential NULL pointer dereference | From | Allen <> | Date | Mon, 23 Sep 2019 21:34:50 +0530 |
| |
> > If I'm looking at this right you are jumping to err_free_netdev without > setting the err variable. It must had been set to 0 from the return of > fjes_sw_init(). This means we will free the netdev, and return 0. This > means probe will not fail and driver's remove function will be run > at some point. fjes_remove it will try to free the netdev again.
Good catch. Here's a quick diff what I should have done,
--- a/drivers/net/fjes/fjes_main.c +++ b/drivers/net/fjes/fjes_main.c @@ -1236,9 +1236,21 @@ static int fjes_probe(struct platform_device *plat_dev) adapter->force_reset = false; adapter->open_guard = false;
+ /* Re-initialize err to -ENOMEM to handle workqueue allocation failures, + and we don't return 0 on failure. + */ + err = -ENOMEM; + adapter->txrx_wq = alloc_workqueue(DRV_NAME "/txrx", WQ_MEM_RECLAIM, 0); + if (unlikely(!adapter->txrx_wq)) + goto err_free_netdev; + adapter->control_wq = alloc_workqueue(DRV_NAME "/control", WQ_MEM_RECLAIM, 0); + if (unlikely(!adapter->control_wq)) { + destroy_workqueue(adapter->txrx_wq); + goto err_free_netdev; + }
> Looks like there's another existing bug here in that the work queues > are not free when something fails in fjes_probe, just the netdev.
I shall look into it and send out a separate fix. > Once you untangle that, and before you post a v2, could you please try > to identify which commit introduced the regression and provide an > appropriate "Fixes" tag? >
Fixes: f2edc4e1b078("net: fjes: fjes_main: Remove create_workqueue")
- Allen
| |