From 96c201a2f43ea49a65f32929494ac68f2b08b9a3 Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 22 Sep 2026 16:24:33 -0700 Subject: [PATCH] net: systemport: Fix NULL pointer dereference in bcm_sysport_fini_rx_ring() If allocation of priv->rx_cbs fails during bcm_sysport_init_rx_ring(), error unwinding in bcm_sysport_open() calls bcm_sysport_fini_rx_ring(). Without checking if priv->rx_cbs is non-NULL, bcm_sysport_fini_rx_ring() dereferences priv->rx_cbs, resulting in a NULL pointer dereference. Add a check for !priv->rx_cbs at the beginning of bcm_sysport_fini_rx_ring(), matching bcm_sysport_fini_tx_ring(). Cc: stable+noautosel@kernel.org # unlikely driver error path Reviewed-by: Nicolai Buchwitz Signed-off-by: Florian Fainelli Link: https://patch.msgid.link/20260922232440.598918-4-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/broadcom/bcmsysport.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c index 8a566b98f486..4d8c7d2f24a4 100644 --- a/drivers/net/ethernet/broadcom/bcmsysport.c +++ b/drivers/net/ethernet/broadcom/bcmsysport.c @@ -1717,6 +1717,9 @@ static void bcm_sysport_fini_rx_ring(struct bcm_sysport_priv *priv) if (!(reg & RDMA_DISABLED)) netdev_warn(priv->netdev, "RDMA not stopped!\n"); + if (!priv->rx_cbs) + return; + for (i = 0; i < priv->num_rx_bds; i++) { cb = &priv->rx_cbs[i]; if (dma_unmap_addr(cb, dma_addr))