bnxt_en: Fix NULL pointer dereference in a failure path during open.

Orabug: 25645429

If bnxt_hwrm_ring_free() is called during a failure path in bnxt_open(),
it is possible that the completion rings have not been allocated yet.
In that case, the completion doorbell has not been initialized, and
calling bnxt_disable_int() will crash.  Fix it by checking that the
completion ring has been initialized before writing to the completion
ring doorbell.

Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit daf1f1e7841138cb0e48d52c8573a5f064d8f495)
Signed-off-by: Brian Maly <brian.maly@oracle.com>

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index 77bfc12d99cf5e1eec4979de82ab32e9a9977877..f5b65fcac21500044aee74c2559d216c54dcddae 100644 (file)
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -3110,8 +3110,10 @@ static void bnxt_disable_int(struct bnxt *bp)
        for (i = 0; i < bp->cp_nr_rings; i++) {
                struct bnxt_napi *bnapi = bp->bnapi[i];
                struct bnxt_cp_ring_info *cpr = &bnapi->cp_ring;
+               struct bnxt_ring_struct *ring = &cpr->cp_ring_struct;
 
-               BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
+               if (ring->fw_ring_id != INVALID_HW_RING_ID)
+                       BNXT_CP_DB(cpr->cp_doorbell, cpr->cp_raw_cons);
        }
 }