[PATCH] net/enic: fix possible null dereference in notify set

[Alexey Simakov]

The memset of notify_addr in vnic_dev_notify_setcmd() was performed
unconditionally before the device reset check. When the device is in
reset, vnic_dev_notify_set() skips the notification buffer allocation,
leaving notify_addr as NULL. The subsequent call to
vnic_dev_notify_setcmd() would then dereference the NULL pointer via
memset.

Move the memset inside the existing !vnic_dev_in_reset() guard where
notify_addr is guaranteed to be valid.

Fixes: 9913fbb91df0 ("enic/base: common code")
Cc: stable at dpdk.org

Signed-off-by: Alexey Simakov <bigalex934 at gmail.com>
---
 drivers/net/enic/base/vnic_dev.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/enic/base/vnic_dev.c b/drivers/net/enic/base/vnic_dev.c
index ba8ecc16f2..e6d34622af 100644
--- a/drivers/net/enic/base/vnic_dev.c
+++ b/drivers/net/enic/base/vnic_dev.c
@@ -964,8 +964,8 @@ int vnic_dev_notify_setcmd(struct vnic_dev *vdev,
 	int wait = 1000;
 	int r;
 
-	memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
 	if (!vnic_dev_in_reset(vdev)) {
+		memset(notify_addr, 0, sizeof(struct vnic_devcmd_notify));
 		vdev->notify = notify_addr;
 		vdev->notify_pa = notify_pa;
 	}
-- 
2.34.1