Commit:     3bba11e5c47dfc1d381a1ece26464fb7eea2d79c
Parent:     9418d5dc9ba40b88737580457bf3b7c63c60ec43
Author:     Ali Ayoub <[EMAIL PROTECTED]>
AuthorDate: Tue Nov 13 15:26:57 2007 -0800
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Tue Nov 13 15:26:57 2007 -0800

    mlx4_core: Fix possible bad free in mlx4_buf_free()
    When mlx4_buf_free() is called from the error path of
    mlx4_buf_alloc(), it may be passed a buffer structure that does not
    have all pages filled in.  Add a check for NULL to mlx4_buf_free() so
    we avoid passing NULL to dma_free_coherent() (which will crash).
    Signed-off-by: Ali Ayoub <[EMAIL PROTECTED]>
    Signed-off-by: Jack Morgenstein <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
 drivers/net/mlx4/alloc.c |    7 ++++---
 1 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index f8d63d3..b226e01 100644
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -171,9 +171,10 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct 
mlx4_buf *buf)
        else {
                for (i = 0; i < buf->nbufs; ++i)
-                       dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                         buf->u.page_list[i].buf,
-                                         buf->u.page_list[i].map);
+                       if (buf->u.page_list[i].buf)
+                               dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
+                                                 buf->u.page_list[i].buf,
+                                                 buf->u.page_list[i].map);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to