From: Fugang Duan fugang.duan@nxp.com

stable inclusion from stable-5.10.42 commit 8ee7ef4a57a9e1228b6f345aaa70aa8951c7e9cd bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BGVY CVE: CVE-2021-47150

----------------------------------------------

If the memory allocated for cbd_base is failed, it should free the memory allocated for the queues, otherwise it causes memory leak.

And if the memory allocated for the queues is failed, it can return error directly.

Fixes: 59d0f7465644 ("net: fec: init multi queue date structure") Signed-off-by: Fugang Duan fugang.duan@nxp.com Signed-off-by: Joakim Zhang qiangqing.zhang@nxp.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Zhang Zekun zhangzekun11@huawei.com --- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 296ae1e4c322..3e402c9b3598 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3147,7 +3147,9 @@ static int fec_enet_init(struct net_device *ndev) return ret; }

- fec_enet_alloc_queue(ndev); + ret = fec_enet_alloc_queue(ndev); + if (ret) + return ret;

bd_size = (fep->total_tx_ring_size + fep->total_rx_ring_size) * dsize;

@@ -3155,7 +3157,8 @@ static int fec_enet_init(struct net_device *ndev) cbd_base = dmam_alloc_coherent(&fep->pdev->dev, bd_size, &bd_dma, GFP_KERNEL); if (!cbd_base) { - return -ENOMEM; + ret = -ENOMEM; + goto free_queue_mem; }

memset(cbd_base, 0, bd_size); @@ -3235,6 +3238,10 @@ static int fec_enet_init(struct net_device *ndev) fec_enet_update_ethtool_stats(ndev);

return 0; + +free_queue_mem: + fec_enet_free_queue(ndev); + return ret; }

#ifdef CONFIG_OF