CC David and Boris (Konrad was already a recipient).
On Thu, Oct 15, 2015 at 10:34:15AM +0800, Joe Jin wrote:
> Sometimes xennet_create_queues() may failed to created all requested
> queues, we need to update num_queues to real created to avoid NULL
> pointer dereference.
>
> Signed-off-by: Joe Jin <joe.jin@xxxxxxxxxx>
> Cc: Wei Liu <wei.liu2@xxxxxxxxxx>
> Cc: Ian Campbell <ian.campbell@xxxxxxxxxx>
> Cc: David S. Miller <davem@xxxxxxxxxxxxx>
> ---
> drivers/net/xen-netfront.c | 9 ++++++---
> 1 files changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
> index f821a97..d580aec 100644
> --- a/drivers/net/xen-netfront.c
> +++ b/drivers/net/xen-netfront.c
> @@ -1746,7 +1746,7 @@ static int xennet_create_queues(struct netfront_info *info,
> dev_err(&info->netdev->dev, "no queues\n");
> return -EINVAL;
> }
> - return 0;
> + return num_queues;
> }
>
> /* Common code used when first setting up, and when resuming. */
> @@ -1788,9 +1788,12 @@ static int talk_to_netback(struct xenbus_device *dev,
> if (info->queues)
> xennet_destroy_queues(info);
>
> - err = xennet_create_queues(info, num_queues);
> - if (err < 0)
> + /* Update queues number to real created */
> + num_queues = xennet_create_queues(info, num_queues);
> + if (num_queues < 0) {
> + err = num_queues;
> goto destroy_ring;
> + }
>
> /* Create shared ring, alloc event channel -- for each queue */
> for (i = 0; i < num_queues; ++i) {
> --
> 1.7.1
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html