mlx4_core: Fix possible bad free in mlx4_buf_free()

When mlx4_buf_free() is called from the error path of
mlx4_buf_alloc(), it may be passed a buffer structure that does not
have all pages filled in.  Add a check for NULL to mlx4_buf_free() so
we avoid passing NULL to dma_free_coherent() (which will crash).

Signed-off-by: Ali Ayoub <ali@mellanox.co.il>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/net/mlx4/alloc.c b/drivers/net/mlx4/alloc.c
index f8d63d39f59246bc80da046ee72963e2303c8644..b226e019bc8b70ab18fee4d8a8c6f6540f40711e 100644 (file)
--- a/drivers/net/mlx4/alloc.c
+++ b/drivers/net/mlx4/alloc.c
@@ -171,9 +171,10 @@ void mlx4_buf_free(struct mlx4_dev *dev, int size, struct mlx4_buf *buf)
                                  buf->u.direct.map);
        else {
                for (i = 0; i < buf->nbufs; ++i)
-                       dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
-                                         buf->u.page_list[i].buf,
-                                         buf->u.page_list[i].map);
+                       if (buf->u.page_list[i].buf)
+                               dma_free_coherent(&dev->pdev->dev, PAGE_SIZE,
+                                                 buf->u.page_list[i].buf,
+                                                 buf->u.page_list[i].map);
                kfree(buf->u.page_list);
        }
 }