Commit ca88ea12 authored by Joe Jin's avatar Joe Jin Committed by David S. Miller
Browse files

xen-netfront: update num_queues to real created



Sometimes xennet_create_queues() may failed to created all requested
queues, we need to update num_queues to real created to avoid NULL
pointer dereference.

Signed-off-by: default avatarJoe Jin <joe.jin@oracle.com>
Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Wei Liu <wei.liu2@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: David S. Miller <davem@davemloft.net>
Reviewed-by: default avatarBoris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f6a835bb
Loading
Loading
Loading
Loading
+7 −7
Original line number Original line Diff line number Diff line
@@ -1706,19 +1706,19 @@ static void xennet_destroy_queues(struct netfront_info *info)
}
}


static int xennet_create_queues(struct netfront_info *info,
static int xennet_create_queues(struct netfront_info *info,
				unsigned int num_queues)
				unsigned int *num_queues)
{
{
	unsigned int i;
	unsigned int i;
	int ret;
	int ret;


	info->queues = kcalloc(num_queues, sizeof(struct netfront_queue),
	info->queues = kcalloc(*num_queues, sizeof(struct netfront_queue),
			       GFP_KERNEL);
			       GFP_KERNEL);
	if (!info->queues)
	if (!info->queues)
		return -ENOMEM;
		return -ENOMEM;


	rtnl_lock();
	rtnl_lock();


	for (i = 0; i < num_queues; i++) {
	for (i = 0; i < *num_queues; i++) {
		struct netfront_queue *queue = &info->queues[i];
		struct netfront_queue *queue = &info->queues[i];


		queue->id = i;
		queue->id = i;
@@ -1728,7 +1728,7 @@ static int xennet_create_queues(struct netfront_info *info,
		if (ret < 0) {
		if (ret < 0) {
			dev_warn(&info->netdev->dev,
			dev_warn(&info->netdev->dev,
				 "only created %d queues\n", i);
				 "only created %d queues\n", i);
			num_queues = i;
			*num_queues = i;
			break;
			break;
		}
		}


@@ -1738,11 +1738,11 @@ static int xennet_create_queues(struct netfront_info *info,
			napi_enable(&queue->napi);
			napi_enable(&queue->napi);
	}
	}


	netif_set_real_num_tx_queues(info->netdev, num_queues);
	netif_set_real_num_tx_queues(info->netdev, *num_queues);


	rtnl_unlock();
	rtnl_unlock();


	if (num_queues == 0) {
	if (*num_queues == 0) {
		dev_err(&info->netdev->dev, "no queues\n");
		dev_err(&info->netdev->dev, "no queues\n");
		return -EINVAL;
		return -EINVAL;
	}
	}
@@ -1788,7 +1788,7 @@ static int talk_to_netback(struct xenbus_device *dev,
	if (info->queues)
	if (info->queues)
		xennet_destroy_queues(info);
		xennet_destroy_queues(info);


	err = xennet_create_queues(info, num_queues);
	err = xennet_create_queues(info, &num_queues);
	if (err < 0)
	if (err < 0)
		goto destroy_ring;
		goto destroy_ring;