In tf_sram_mgr_alloc(), two sequential 64B blocks are allocated from
the resource manager before the tf_sram_block tracking structure is
created with tf_sram_alloc_block(). If that allocation fails it
returns NULL, but the NULL result was not checked: the RM indices
stayed marked in use and could never be reused, and the NULL block
was then dereferenced via block->block_id.
Release both RM indices and return -ENOMEM when the block structure
cannot be allocated, as is already done when the two indices are not
sequential.
Fixes: 37ff91c158a3 ("net/bnxt: add SRAM manager model")
Cc: [email protected]
Signed-off-by: Manish Kurup <[email protected]>
---
v2:
* Split out of "net/bnxt: fix multiple truflow defects" (one fix per
patch); this is the tf_sram_mgr_alloc() fix.
* New subject and commit message (also notes the NULL dereference);
single Fixes: tag.
drivers/net/bnxt/tf_core/tf_sram_mgr.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/bnxt/tf_core/tf_sram_mgr.c
b/drivers/net/bnxt/tf_core/tf_sram_mgr.c
index 0dffd74cd5..70bdb0ba1b 100644
--- a/drivers/net/bnxt/tf_core/tf_sram_mgr.c
+++ b/drivers/net/bnxt/tf_core/tf_sram_mgr.c
@@ -710,6 +710,15 @@ int tf_sram_mgr_alloc(void *sram_handle,
}
block_id = index;
block = tf_sram_alloc_block(slice_list, block_id);
+ if (unlikely(!block)) {
+ fparms.index = index;
+ fparms.subtype = parms->tbl_type;
+ fparms.rm_db = parms->rm_db;
+ tf_rm_free(&fparms);
+ fparms.index = next_index;
+ tf_rm_free(&fparms);
+ return -ENOMEM;
+ }
} else {
/* Block exists
--
2.31.1
