bnxt_set_features() takes a snapshot of bp->flags, closes the device, and then blindly restores the entire bp->flags. bp->flags contains statistics flags that may be cleared and the memory freed when irq_re_init is true. Do not restore these statistics flags until bnxt_open_nic() reallocates the memory. bnxt_open_nic() can potentially fail to allocate the stats memory and the restored flags can potentially cause NULL dereference of the stats memory. Fixes: 93e90104bd12 ("bnxt_en: Create and setup the additional VNIC for adding ntuple filters") Reviewed-by: Andy Gospodarek Signed-off-by: Michael Chan --- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c index 51557ee6c9ad..c34360f1e004 100644 --- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c @@ -14091,7 +14091,8 @@ static int bnxt_reinit_features(struct bnxt *bp, bool irq_re_init, bool link_re_init, u32 flags, bool update_tpa) { bnxt_close_nic(bp, irq_re_init, link_re_init); - bp->flags = flags; + bp->flags = (bp->flags & ~BNXT_FLAG_ALL_CONFIG_FEATS) | + (flags & BNXT_FLAG_ALL_CONFIG_FEATS); if (update_tpa) bnxt_set_ring_params(bp); return bnxt_open_nic(bp, irq_re_init, link_re_init); -- 2.51.0