Re: Re: [PATCH] bnx2x: fix NULL pointer dereference in bnx2x_free_mem_bp()

[Jiangshan Yi]

> > +	if (bp->fp) {
> there is no need to put this defensive code ...
> > +		for (i = 0; i < bp->fp_array_size; i++)
> > +			kfree(bp->fp[i].tpa_info);
> > +	}
> ......
> > -	bp->fp_array_size = fp_array_size;
> > -	BNX2X_DEV_INFO("fp_array_size %d\n", bp->fp_array_size);
> > +	BNX2X_DEV_INFO("fp_array_size %d\n", fp_array_size);
> >   
> > -	fp = kzalloc_objs(*fp, bp->fp_array_size);
> > +	fp = kzalloc_objs(*fp, fp_array_size);
> >   	if (!fp)
> >   		goto alloc_err;
> >   	bp->fp = fp;
> > +	bp->fp_array_size = fp_array_size;
> ... when you have fixed the root cause of the issue


Hi Vadim,

Thanks for the review. You're right - once the bp->fp_array_size assignment is moved after bp->fp is set, the loop in bnx2x_free_mem_bp() naturally won't execute
when bp->fp is NULL, since bp->fp_array_size remains zero. The if (bp->fp) guard is indeed redundant. I'll remove it and send a v2 with only the assignment-order
fix.

Best regards,
Jiangshan Yi