From: Fugang Duan fugang.duan@nxp.com

stable inclusion from stable-v4.19.193 commit 15102886bc8f5f29daaadf2d925591d564c17e9f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BGVY CVE: CVE-2021-47150

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

---------------------------------------------

[ Upstream commit 619fee9eb13b5d29e4267cb394645608088c28a8 ]

If the memory allocated for cbd_base is failed, it should free the memory allocated for the queues, otherwise it causes memory leak.

And if the memory allocated for the queues is failed, it can return error directly.

Fixes: 59d0f7465644 ("net: fec: init multi queue date structure") Signed-off-by: Fugang Duan fugang.duan@nxp.com Signed-off-by: Joakim Zhang qiangqing.zhang@nxp.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/net/ethernet/freescale/fec_main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c index 296ae1e4c322..3e402c9b3598 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -3147,7 +3147,9 @@ static int fec_enet_init(struct net_device *ndev) return ret; }

- fec_enet_alloc_queue(ndev); + ret = fec_enet_alloc_queue(ndev); + if (ret) + return ret;

bd_size = (fep->total_tx_ring_size + fep->total_rx_ring_size) * dsize;

@@ -3155,7 +3157,8 @@ static int fec_enet_init(struct net_device *ndev) cbd_base = dmam_alloc_coherent(&fep->pdev->dev, bd_size, &bd_dma, GFP_KERNEL); if (!cbd_base) { - return -ENOMEM; + ret = -ENOMEM; + goto free_queue_mem; }

memset(cbd_base, 0, bd_size); @@ -3235,6 +3238,10 @@ static int fec_enet_init(struct net_device *ndev) fec_enet_update_ethtool_stats(ndev);

return 0; + +free_queue_mem: + fec_enet_free_queue(ndev); + return ret; }

#ifdef CONFIG_OF